IOC Report
rQuotation.exe

loading gif

Files

File Path
Type
Category
Malicious
rQuotation.exe
PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rQuotation.exe_e4f27283d01878559fa8842b7cf5abf4516a719_5a22651d_971fdfdb-35fe-474f-9556-a675ed73134a\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER12E6.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1316.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERFF7.tmp.dmp
Mini DuMP crash report, 16 streams, Mon Jul 1 16:42:59 2024, 0x1205a4 type
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\rQuotation.exe
"C:\Users\user\Desktop\rQuotation.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 6476 -s 1120

URLs

Name
IP
Malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://terminal4.veeblehosting.com
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
https://account.dyn.com/
unknown
http://www.fontbureau.com/designers?
unknown
http://www.tiro.com
unknown
http://upx.sf.net
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://ip-api.com
unknown
http://r3.o.lencr.org0
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://r3.i.lencr.org/0&
unknown
There are 25 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
ip-api.com
208.95.112.1
 malicious
terminal4.veeblehosting.com
108.170.55.203
 malicious

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
malicious
108.170.55.203
terminal4.veeblehosting.com
United States
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
FileDirectory
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
ProgramId
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
FileId
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
LowerCaseLongPath
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
LongPathHash
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
Name
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
OriginalFileName
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
Publisher
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
Version
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
BinFileVersion
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
BinaryType
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
ProductName
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
ProductVersion
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
LinkDate
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
BinProductVersion
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
AppxPackageFullName
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
AppxPackageRelativeId
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
Size
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
Language
\REGISTRY\A\{06efb718-7a17-877d-cc1f-149de1f981f0}\Root\InventoryApplicationFile\rquotation.exe|d54f880fab411311
Usn
There are 24 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2ED1000
trusted library allocation
page read and write
 malicious
1912044B000
trusted library allocation
page read and write
 malicious
191105E8000
trusted library allocation
page read and write
 malicious
2EFE000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
2F21000
trusted library allocation
page read and write
 malicious
2CA7000
trusted library allocation
page execute and read and write
6350000
heap
page read and write
3F07000
trusted library allocation
page read and write
6B7E000
stack
page read and write
1910E8C0000
heap
page read and write
7FFD9B770000
trusted library allocation
page read and write
191208EA000
trusted library allocation
page read and write
54C0000
trusted library allocation
page read and write
5512000
trusted library allocation
page read and write
4C266FE000
stack
page read and write
DBA000
stack
page read and write
19110373000
trusted library allocation
page read and write
56E0000
heap
page read and write
7FFD9B910000
trusted library allocation
page read and write
1910E6B3000
heap
page read and write
7FFD9B890000
trusted library allocation
page execute and read and write
59DE000
stack
page read and write
4C267FF000
stack
page read and write
1910E8F0000
trusted library section
page readonly
5ADE000
stack
page read and write
2CA2000
trusted library allocation
page read and write
1280000
heap
page read and write
7FFD9B77D000
trusted library allocation
page execute and read and write
2CA0000
trusted library allocation
page read and write
1910E6B0000
heap
page read and write
1912A320000
heap
page read and write
1910E8B0000
trusted library allocation
page read and write
7FFD9B788000
trusted library allocation
page read and write
2C92000
trusted library allocation
page read and write
1910E582000
unkown
page readonly
2D80000
trusted library allocation
page execute and read and write
1912A210000
trusted library section
page read and write
7FFD9B7CC000
trusted library allocation
page execute and read and write
7FFD9B79D000
trusted library allocation
page execute and read and write
7FFD9B930000
trusted library allocation
page read and write
1910E6E4000
heap
page read and write
7FFD9B773000
trusted library allocation
page execute and read and write
5B9E000
stack
page read and write
6940000
trusted library allocation
page read and write
54E0000
trusted library allocation
page read and write
7FFD9B79B000
trusted library allocation
page execute and read and write
7FFD9B970000
trusted library allocation
page execute and read and write
2F29000
trusted library allocation
page read and write
7FF422180000
trusted library allocation
page execute and read and write
2D90000
heap
page execute and read and write
4C265FB000
stack
page read and write
56D0000
heap
page execute and read and write
2C90000
trusted library allocation
page read and write
54EB000
trusted library allocation
page read and write
4C264FC000
stack
page read and write
1115000
heap
page read and write
4C261FF000
stack
page read and write
7FFD9B940000
trusted library allocation
page read and write
7FFD9B782000
trusted library allocation
page read and write
2CA5000
trusted library allocation
page execute and read and write
7FFD9B96A000
trusted library allocation
page read and write
1910E67C000
heap
page read and write
54F2000
trusted library allocation
page read and write
2F1D000
trusted library allocation
page read and write
2C9A000
trusted library allocation
page execute and read and write
1910E840000
heap
page read and write
7FFD9B927000
trusted library allocation
page read and write
58DC000
stack
page read and write
7F5E0000
trusted library allocation
page execute and read and write
4C269FD000
stack
page read and write
54D0000
trusted library allocation
page read and write
4C263FD000
stack
page read and write
7FFD9B830000
trusted library allocation
page execute and read and write
43E000
remote allocation
page execute and read and write
2EFA000
trusted library allocation
page read and write
19128A59000
heap
page read and write
1910E68E000
heap
page read and write
1910EB45000
heap
page read and write
191282A0000
trusted library allocation
page read and write
19129B40000
trusted library allocation
page read and write
558C000
stack
page read and write
503D000
stack
page read and write
7FFD9B820000
trusted library allocation
page read and write
1912A20A000
trusted library section
page read and write
624F000
stack
page read and write
1912068F000
trusted library allocation
page read and write
19120281000
trusted library allocation
page read and write
668E000
stack
page read and write
191101F5000
heap
page read and write
127D000
heap
page read and write
166D000
trusted library allocation
page execute and read and write
2EFC000
trusted library allocation
page read and write
3EC9000
trusted library allocation
page read and write
1910E620000
heap
page read and write
300F000
trusted library allocation
page read and write
165D000
trusted library allocation
page execute and read and write
19120277000
trusted library allocation
page read and write
1910E640000
heap
page read and write
6860000
trusted library allocation
page read and write
2D60000
heap
page read and write
2D5C000
stack
page read and write
56C0000
trusted library allocation
page read and write
67C0000
trusted library allocation
page read and write
1910E6DB000
heap
page read and write
5501000
trusted library allocation
page read and write
1910E73D000
heap
page read and write
6DE0000
heap
page read and write
19128A6B000
heap
page read and write
1910E738000
heap
page read and write
54FA000
trusted library allocation
page read and write
1660000
trusted library allocation
page read and write
130B000
heap
page read and write
1910E975000
heap
page read and write
19128A50000
heap
page read and write
1490000
heap
page read and write
2CAB000
trusted library allocation
page execute and read and write
7FFD9B960000
trusted library allocation
page read and write
1910E731000
heap
page read and write
6950000
trusted library allocation
page read and write
1670000
heap
page read and write
550D000
trusted library allocation
page read and write
5520000
trusted library allocation
page read and write
5506000
trusted library allocation
page read and write
3EA1000
trusted library allocation
page read and write
1240000
heap
page read and write
2CD0000
heap
page read and write
1912A040000
trusted library section
page read and write
1912A360000
heap
page read and write
1654000
trusted library allocation
page read and write
5530000
trusted library allocation
page read and write
67CD000
trusted library allocation
page read and write
685E000
stack
page read and write
1110000
heap
page read and write
1910E880000
trusted library allocation
page read and write
54E6000
trusted library allocation
page read and write
7FFD9B772000
trusted library allocation
page read and write
124B000
heap
page read and write
2D1E000
stack
page read and write
1910E670000
heap
page read and write
19110260000
heap
page execute and read and write
5B5D000
stack
page read and write
19128A40000
heap
page read and write
1912027D000
trusted library allocation
page read and write
6DF0000
heap
page read and write
10F9000
stack
page read and write
1912A35D000
heap
page read and write
2E9F000
stack
page read and write
680D000
stack
page read and write
7FFD9B780000
trusted library allocation
page read and write
191102D3000
trusted library allocation
page read and write
54FE000
trusted library allocation
page read and write
191101F0000
heap
page read and write
1910E580000
unkown
page readonly
1910E6DE000
heap
page read and write
4C262FE000
stack
page read and write
400000
remote allocation
page execute and read and write
4C25FFF000
stack
page read and write
1910E676000
heap
page read and write
19129F40000
heap
page read and write
7FFD9B92C000
trusted library allocation
page read and write
566E000
stack
page read and write
12D5000
heap
page read and write
4C25EF2000
stack
page read and write
56C9000
trusted library allocation
page read and write
2C96000
trusted library allocation
page execute and read and write
6356000
heap
page read and write
1210000
heap
page read and write
635C000
heap
page read and write
562E000
stack
page read and write
1910E8B3000
trusted library allocation
page read and write
56AD000
stack
page read and write
1274000
heap
page read and write
67B0000
trusted library allocation
page read and write
67A0000
trusted library allocation
page read and write
7FFD9B920000
trusted library allocation
page read and write
7FFD9B962000
trusted library allocation
page read and write
2F10000
trusted library allocation
page read and write
1130000
heap
page read and write
7FFD9B794000
trusted library allocation
page read and write
7FFD9B82C000
trusted library allocation
page execute and read and write
63D4000
heap
page read and write
19129B62000
trusted library allocation
page read and write
7FFD9B826000
trusted library allocation
page read and write
7FFD9B856000
trusted library allocation
page execute and read and write
6810000
trusted library allocation
page execute and read and write
6790000
trusted library allocation
page execute and read and write
7FFD9B790000
trusted library allocation
page read and write
7FFD9B78D000
trusted library allocation
page execute and read and write
7FFD9B950000
trusted library allocation
page read and write
2EA1000
trusted library allocation
page read and write
4C260FE000
stack
page read and write
1640000
trusted library allocation
page read and write
1910E699000
heap
page read and write
2CC0000
trusted library allocation
page read and write
1911027D000
trusted library allocation
page read and write
56B0000
heap
page read and write
6867000
trusted library allocation
page read and write
6370000
heap
page read and write
1910E970000
heap
page read and write
1910E8A0000
trusted library allocation
page read and write
67A7000
trusted library allocation
page read and write
19120271000
trusted library allocation
page read and write
7FFD9B916000
trusted library allocation
page read and write
6E40000
trusted library allocation
page execute and read and write
6C7E000
stack
page read and write
1912A6D0000
heap
page execute and read and write
1910E610000
heap
page read and write
6377000
heap
page read and write
1910E900000
heap
page read and write
1676000
heap
page read and write
55E0000
heap
page read and write
2F04000
trusted library allocation
page read and write
7FFD9B774000
trusted library allocation
page read and write
54EE000
trusted library allocation
page read and write
4C268FE000
stack
page read and write
678D000
stack
page read and write
7FFD9B980000
trusted library allocation
page read and write
1653000
trusted library allocation
page execute and read and write
1910EB40000
heap
page read and write
4EA8000
trusted library allocation
page read and write
1910E910000
heap
page read and write
1910E765000
heap
page read and write
19110271000
trusted library allocation
page read and write
55E3000
heap
page read and write
1650000
trusted library allocation
page read and write
There are 216 hidden memdumps, click here to show them.