IOC Report
lista de cotizaciones.xlam.exe

loading gif

Files

File Path
Type
Category
Malicious
lista de cotizaciones.xlam.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\Keily
ASCII text, with very long lines (28756), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\aut30C2.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut3111.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\lophophorine
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\lista de cotizaciones.xlam.exe
"C:\Users\user\Desktop\lista de cotizaciones.xlam.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\lista de cotizaciones.xlam.exe"
 malicious

URLs

Name
IP
Malicious
https://api.telegram.org/bot
unknown
 malicious
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
132.226.8.169
http://checkip.dyndns.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown

Domains

Name
IP
Malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
132.226.8.169

IPs

IP
Domain
Country
Malicious
132.226.8.169
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
CA0000
direct allocation
page read and write
 malicious
2F4A000
trusted library allocation
page read and write
 malicious
402000
system
page execute and read and write
 malicious
2E81000
trusted library allocation
page read and write
 malicious
12D0000
trusted library allocation
page execute and read and write
EA0000
heap
page read and write
DF0000
heap
page read and write
9BF000
stack
page read and write
200000
unkown
page readonly
106B000
trusted library allocation
page execute and read and write
6320000
heap
page read and write
9DB000
stack
page read and write
601E000
stack
page read and write
9FC000
stack
page read and write
580E000
stack
page read and write
2B5000
unkown
page readonly
1030000
trusted library allocation
page read and write
2F31000
trusted library allocation
page read and write
13E0000
trusted library allocation
page read and write
D95000
heap
page read and write
1065000
trusted library allocation
page execute and read and write
2DED000
stack
page read and write
1070000
heap
page read and write
36E0000
direct allocation
page read and write
F11000
heap
page read and write
1300000
heap
page read and write
2F9F000
trusted library allocation
page read and write
DF0000
heap
page read and write
104D000
trusted library allocation
page execute and read and write
5830000
trusted library allocation
page execute and read and write
2F7D000
trusted library allocation
page read and write
2DFE000
trusted library allocation
page read and write
3663000
direct allocation
page read and write
13FF000
trusted library allocation
page read and write
115F000
heap
page read and write
3663000
direct allocation
page read and write
387E000
direct allocation
page read and write
13F0000
trusted library allocation
page read and write
2FDF000
trusted library allocation
page read and write
ED2000
heap
page read and write
1400000
heap
page read and write
DAF000
heap
page read and write
6350000
trusted library allocation
page read and write
3809000
direct allocation
page read and write
2E16000
trusted library allocation
page read and write
2C8000
unkown
page readonly
5F1F000
stack
page read and write
2C3000
unkown
page write copy
28F000
unkown
page readonly
1050000
trusted library allocation
page read and write
6330000
trusted library allocation
page read and write
2C8000
unkown
page readonly
C90000
heap
page read and write
380D000
direct allocation
page read and write
3809000
direct allocation
page read and write
387E000
direct allocation
page read and write
3EEA000
trusted library allocation
page read and write
2FE5000
trusted library allocation
page read and write
2E11000
trusted library allocation
page read and write
2F8C000
trusted library allocation
page read and write
F01000
heap
page read and write
57CE000
stack
page read and write
DA4000
heap
page read and write
387E000
direct allocation
page read and write
535E000
trusted library allocation
page read and write
1040000
trusted library allocation
page read and write
2F3D000
trusted library allocation
page read and write
108E000
heap
page read and write
2DFB000
trusted library allocation
page read and write
DAC000
heap
page read and write
BD0000
heap
page read and write
C00000
heap
page read and write
3540000
direct allocation
page read and write
3809000
direct allocation
page read and write
3809000
direct allocation
page read and write
2E30000
heap
page read and write
2DAF000
stack
page read and write
12F0000
trusted library allocation
page read and write
5840000
trusted library allocation
page execute and read and write
5340000
trusted library allocation
page execute and read and write
201000
unkown
page execute read
ED2000
heap
page read and write
56C0000
heap
page execute and read and write
380D000
direct allocation
page read and write
1060000
trusted library allocation
page read and write
5357000
trusted library allocation
page read and write
105A000
trusted library allocation
page execute and read and write
D70000
heap
page read and write
3540000
direct allocation
page read and write
3F0E000
trusted library allocation
page read and write
1139000
heap
page read and write
6220000
heap
page read and write
156E000
stack
page read and write
2F3A000
trusted library allocation
page read and write
DF0000
heap
page read and write
10F6000
heap
page read and write
1020000
trusted library allocation
page read and write
3663000
direct allocation
page read and write
12CE000
stack
page read and write
535B000
trusted library allocation
page read and write
2F2C000
trusted library allocation
page read and write
13D0000
heap
page execute and read and write
EF1000
heap
page read and write
2F83000
trusted library allocation
page read and write
C04000
heap
page read and write
2BF000
unkown
page write copy
13B0000
trusted library allocation
page read and write
5810000
trusted library allocation
page read and write
EA5000
heap
page read and write
3540000
direct allocation
page read and write
2E33000
heap
page read and write
3540000
direct allocation
page read and write
9CF000
stack
page read and write
1062000
trusted library allocation
page read and write
533D000
stack
page read and write
36E0000
direct allocation
page read and write
DF0000
heap
page read and write
36E0000
direct allocation
page read and write
DA5000
heap
page read and write
D78000
heap
page read and write
3663000
direct allocation
page read and write
EF1000
heap
page read and write
3540000
direct allocation
page read and write
621E000
stack
page read and write
6233000
heap
page read and write
6780000
heap
page read and write
3809000
direct allocation
page read and write
2B5000
unkown
page readonly
EF1000
heap
page read and write
3663000
direct allocation
page read and write
EBA000
heap
page read and write
10AE000
heap
page read and write
DBE000
heap
page read and write
387E000
direct allocation
page read and write
387E000
direct allocation
page read and write
36E0000
direct allocation
page read and write
1067000
trusted library allocation
page execute and read and write
3663000
direct allocation
page read and write
2BF000
unkown
page read and write
DA4000
heap
page read and write
3F0000
heap
page read and write
380D000
direct allocation
page read and write
103D000
trusted library allocation
page execute and read and write
B80000
heap
page read and write
2F34000
trusted library allocation
page read and write
F01000
heap
page read and write
2E60000
trusted library allocation
page read and write
380D000
direct allocation
page read and write
1078000
heap
page read and write
2E1D000
trusted library allocation
page read and write
E9B000
heap
page read and write
200000
unkown
page readonly
DBE000
heap
page read and write
2F9B000
trusted library allocation
page read and write
2E0E000
trusted library allocation
page read and write
BE7000
stack
page read and write
3E81000
trusted library allocation
page read and write
2DF6000
trusted library allocation
page read and write
387E000
direct allocation
page read and write
DCD000
heap
page read and write
12E0000
trusted library allocation
page read and write
DF1000
heap
page read and write
52FE000
stack
page read and write
5820000
trusted library allocation
page read and write
2FEB000
trusted library allocation
page read and write
1033000
trusted library allocation
page execute and read and write
2E70000
heap
page read and write
36E0000
direct allocation
page read and write
2F46000
trusted library allocation
page read and write
28F000
unkown
page readonly
380D000
direct allocation
page read and write
4F7E000
stack
page read and write
13FC000
trusted library allocation
page read and write
5350000
trusted library allocation
page read and write
196E000
stack
page read and write
F80000
heap
page read and write
2FD8000
trusted library allocation
page read and write
FE0000
heap
page read and write
5400000
heap
page read and write
3540000
direct allocation
page read and write
3809000
direct allocation
page read and write
BF0000
direct allocation
page execute and read and write
622D000
heap
page read and write
13FA000
trusted library allocation
page read and write
3F1A000
trusted library allocation
page read and write
DF0000
heap
page read and write
2F29000
trusted library allocation
page read and write
2F78000
trusted library allocation
page read and write
B50000
heap
page read and write
DF0000
heap
page read and write
109A000
heap
page read and write
1056000
trusted library allocation
page execute and read and write
B4E000
stack
page read and write
DC8000
heap
page read and write
1034000
trusted library allocation
page read and write
E10000
heap
page read and write
1280000
trusted library allocation
page read and write
422000
system
page execute and read and write
2DF0000
trusted library allocation
page read and write
567E000
stack
page read and write
AEA000
stack
page read and write
DAF000
heap
page read and write
EA8000
heap
page read and write
E50000
heap
page read and write
2F96000
trusted library allocation
page read and write
3EA9000
trusted library allocation
page read and write
400000
system
page execute and read and write
38A000
stack
page read and write
3F05000
trusted library allocation
page read and write
2E0A000
trusted library allocation
page read and write
ED2000
heap
page read and write
36E0000
direct allocation
page read and write
380D000
direct allocation
page read and write
201000
unkown
page execute read
B0E000
stack
page read and write
DF0000
heap
page read and write
There are 206 hidden memdumps, click here to show them.