IOC Report
DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe

loading gif

Files

File Path
Type
Category
Malicious
DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KaGeys.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\aut5C61.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut5CCF.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\flexuoseness
ASCII text, with very long lines (28756), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\woolpress
data
dropped
C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
modified
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe
"C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe"
 malicious
C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe
"C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe"
malicious
C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe
"C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.13.205
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
http://mail.laboratoriosvilla.com.mx
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://ip-api.com
unknown
http://r10.o.lencr.org0#
unknown
http://laboratoriosvilla.com.mx
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://r10.i.lencr.org/0
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
There are 3 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
laboratoriosvilla.com.mx
216.194.161.167
 malicious
ip-api.com
208.95.112.1
 malicious
mail.laboratoriosvilla.com.mx
unknown
 malicious
api.ipify.org
104.26.13.205

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
malicious
216.194.161.167
laboratoriosvilla.com.mx
United States
malicious
104.26.13.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
KaGeys
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
280B000
trusted library allocation
page read and write
 malicious
27E5000
trusted library allocation
page read and write
 malicious
40D0000
direct allocation
page read and write
 malicious
2823000
trusted library allocation
page read and write
 malicious
3B2000
system
page execute and read and write
 malicious
43D9000
direct allocation
page read and write
184B000
heap
page read and write
657E000
stack
page read and write
507E000
stack
page read and write
4233000
direct allocation
page read and write
4AC0000
trusted library allocation
page read and write
27CD000
trusted library allocation
page read and write
183C000
heap
page read and write
1BF000
unkown
page write copy
4B26000
trusted library allocation
page read and write
2410000
heap
page read and write
193E000
heap
page read and write
27D1000
trusted library allocation
page read and write
C40000
trusted library allocation
page read and write
43DD000
direct allocation
page read and write
17FF000
heap
page read and write
4BD0000
heap
page read and write
4300000
direct allocation
page read and write
100000
unkown
page readonly
178D000
stack
page read and write
3B61000
trusted library allocation
page read and write
108A000
heap
page read and write
C23000
trusted library allocation
page execute and read and write
184B000
heap
page read and write
11A4000
trusted library allocation
page read and write
4B21000
trusted library allocation
page read and write
4BC0000
heap
page execute and read and write
61DE000
stack
page read and write
192E000
heap
page read and write
6347000
trusted library allocation
page read and write
18EB000
heap
page read and write
1C3000
unkown
page write copy
609F000
stack
page read and write
790000
heap
page read and write
184B000
heap
page read and write
9BC000
heap
page read and write
27B5000
trusted library allocation
page read and write
8C0000
heap
page read and write
1086000
heap
page read and write
C87000
heap
page read and write
444E000
direct allocation
page read and write
DC0000
heap
page read and write
7F0000
trusted library allocation
page read and write
625E000
stack
page read and write
115E000
stack
page read and write
72C000
stack
page read and write
2407000
trusted library allocation
page execute and read and write
C50000
heap
page read and write
4110000
direct allocation
page read and write
186B000
heap
page read and write
2990000
heap
page read and write
4AD0000
trusted library allocation
page read and write
1640000
heap
page read and write
5360000
heap
page execute and read and write
C74000
heap
page read and write
6350000
trusted library allocation
page read and write
1220000
trusted library allocation
page read and write
42B0000
direct allocation
page read and write
1824000
heap
page read and write
6340000
trusted library allocation
page read and write
7A0000
heap
page read and write
11D7000
trusted library allocation
page execute and read and write
C46000
trusted library allocation
page execute and read and write
1FBE000
stack
page read and write
444E000
direct allocation
page read and write
100000
unkown
page readonly
2420000
trusted library allocation
page read and write
8C8000
heap
page read and write
1094000
heap
page read and write
1928000
heap
page read and write
194D000
heap
page read and write
2470000
heap
page read and write
184C000
heap
page read and write
37A9000
trusted library allocation
page read and write
43D9000
direct allocation
page read and write
25C8000
trusted library allocation
page read and write
62E0000
trusted library allocation
page execute and read and write
58C8000
heap
page read and write
1200000
trusted library allocation
page execute and read and write
43DD000
direct allocation
page read and write
148E000
stack
page read and write
8AE000
stack
page read and write
85E000
stack
page read and write
43DD000
direct allocation
page read and write
1057000
heap
page read and write
4B9C000
stack
page read and write
F1F000
stack
page read and write
9A0000
heap
page read and write
4160000
direct allocation
page read and write
E0E000
stack
page read and write
5080000
heap
page execute and read and write
58A0000
heap
page read and write
4160000
direct allocation
page read and write
27BF000
trusted library allocation
page read and write
66D0000
heap
page read and write
37E9000
trusted library allocation
page read and write
4AF0000
heap
page read and write
5966000
heap
page read and write
1630000
heap
page read and write
4429000
direct allocation
page read and write
50A0000
trusted library allocation
page read and write
4B1A000
trusted library allocation
page read and write
2828000
trusted library allocation
page read and write
4B06000
trusted library allocation
page read and write
51CE000
stack
page read and write
C40000
trusted library allocation
page read and write
B90000
trusted library allocation
page read and write
42B0000
direct allocation
page read and write
C50000
heap
page read and write
4110000
direct allocation
page read and write
2402000
trusted library allocation
page read and write
C24000
trusted library allocation
page read and write
2DC1000
trusted library allocation
page read and write
184B000
heap
page read and write
C5C000
stack
page read and write
B9D000
trusted library allocation
page execute and read and write
184B000
heap
page read and write
B84000
trusted library allocation
page read and write
246E000
stack
page read and write
17FC000
heap
page read and write
5EC0000
heap
page read and write
182E000
heap
page read and write
518E000
stack
page read and write
196D000
heap
page read and write
6277000
trusted library allocation
page read and write
183D000
heap
page read and write
101000
unkown
page execute read
D5A000
stack
page read and write
1160000
heap
page read and write
B3E000
stack
page read and write
BC5000
heap
page read and write
E10000
heap
page read and write
275E000
stack
page read and write
1044000
heap
page read and write
4AF3000
heap
page read and write
42B0000
direct allocation
page read and write
17F4000
heap
page read and write
4233000
direct allocation
page read and write
2DB0000
heap
page execute and read and write
2760000
trusted library allocation
page execute and read and write
43D9000
direct allocation
page read and write
4B0B000
trusted library allocation
page read and write
62D0000
trusted library allocation
page read and write
449E000
direct allocation
page read and write
4429000
direct allocation
page read and write
17C7000
heap
page read and write
621E000
stack
page read and write
101000
unkown
page execute read
8FE000
heap
page read and write
4283000
direct allocation
page read and write
1190000
trusted library allocation
page read and write
4110000
direct allocation
page read and write
626D000
trusted library allocation
page read and write
AFA000
stack
page read and write
444E000
direct allocation
page read and write
94D000
heap
page read and write
444E000
direct allocation
page read and write
42B0000
direct allocation
page read and write
4B00000
trusted library allocation
page read and write
2400000
trusted library allocation
page read and write
C2E000
stack
page read and write
B7E000
stack
page read and write
1FFD000
stack
page read and write
17FF000
heap
page read and write
C10000
trusted library allocation
page read and write
4B0E000
trusted library allocation
page read and write
4300000
direct allocation
page read and write
4B40000
trusted library allocation
page read and write
183C000
heap
page read and write
5914000
heap
page read and write
134F000
stack
page read and write
4B32000
trusted library allocation
page read and write
15FC000
stack
page read and write
4AE0000
trusted library allocation
page read and write
4110000
direct allocation
page read and write
17F5000
heap
page read and write
3DC1000
trusted library allocation
page read and write
1C8000
unkown
page readonly
BBB000
trusted library allocation
page execute and read and write
8FB000
heap
page read and write
740000
heap
page read and write
10C0000
heap
page read and write
556F000
stack
page read and write
11D0000
trusted library allocation
page read and write
442D000
direct allocation
page read and write
4DCC000
stack
page read and write
69A000
unkown
page readonly
63C0000
trusted library allocation
page execute and read and write
138E000
stack
page read and write
1230000
heap
page read and write
5D5E000
stack
page read and write
1B5000
unkown
page readonly
983000
heap
page read and write
11B0000
trusted library allocation
page read and write
1B5000
unkown
page readonly
6390000
heap
page read and write
1C8000
unkown
page readonly
25B0000
heap
page read and write
194D000
heap
page read and write
182E000
heap
page read and write
E25000
heap
page read and write
184B000
heap
page read and write
6360000
trusted library allocation
page read and write
181E000
heap
page read and write
FCA000
stack
page read and write
3781000
trusted library allocation
page read and write
C20000
trusted library allocation
page read and write
4E0E000
stack
page read and write
692000
unkown
page readonly
101E000
stack
page read and write
E20000
heap
page read and write
FFF000
stack
page read and write
BC0000
heap
page read and write
29DC000
stack
page read and write
2AE0000
trusted library allocation
page read and write
256E000
stack
page read and write
998000
heap
page read and write
4283000
direct allocation
page read and write
566E000
stack
page read and write
4233000
direct allocation
page read and write
1BF000
unkown
page read and write
17E5000
heap
page read and write
296E000
stack
page read and write
25AC000
stack
page read and write
2ADE000
stack
page read and write
52CE000
stack
page read and write
17C0000
heap
page read and write
AF0000
heap
page read and write
BFF000
stack
page read and write
449E000
direct allocation
page read and write
730000
heap
page read and write
2836000
trusted library allocation
page read and write
196D000
heap
page read and write
18F000
unkown
page readonly
4233000
direct allocation
page read and write
C30000
trusted library allocation
page read and write
17F4000
heap
page read and write
2440000
direct allocation
page execute and read and write
442D000
direct allocation
page read and write
50A9000
trusted library allocation
page read and write
8EC000
heap
page read and write
2D2C000
stack
page read and write
4429000
direct allocation
page read and write
527E000
stack
page read and write
C3D000
trusted library allocation
page execute and read and write
1490000
trusted library allocation
page execute and read and write
23FE000
stack
page read and write
745000
heap
page read and write
11B4000
trusted library allocation
page read and write
594B000
heap
page read and write
C7B000
heap
page read and write
6260000
trusted library allocation
page read and write
43D9000
direct allocation
page read and write
BB7000
trusted library allocation
page execute and read and write
58C2000
heap
page read and write
4B1E000
trusted library allocation
page read and write
B94000
trusted library allocation
page read and write
15BF000
stack
page read and write
4300000
direct allocation
page read and write
6270000
trusted library allocation
page read and write
4283000
direct allocation
page read and write
190A000
heap
page read and write
43DD000
direct allocation
page read and write
938000
heap
page read and write
CBA000
heap
page read and write
2770000
heap
page execute and read and write
17FF000
heap
page read and write
11F0000
trusted library allocation
page read and write
2434000
heap
page read and write
4EBE000
stack
page read and write
37A000
stack
page read and write
4F0E000
stack
page read and write
C4A000
trusted library allocation
page execute and read and write
181E000
heap
page read and write
690000
unkown
page readonly
4B2D000
trusted library allocation
page read and write
1028000
heap
page read and write
ABE000
stack
page read and write
7F000000
trusted library allocation
page execute and read and write
C30000
trusted library allocation
page execute and read and write
2430000
heap
page read and write
503E000
stack
page read and write
11AD000
trusted library allocation
page execute and read and write
184B000
heap
page read and write
14A0000
heap
page read and write
62BE000
stack
page read and write
4160000
direct allocation
page read and write
1670000
heap
page read and write
2B40000
trusted library allocation
page execute and read and write
4F3E000
stack
page read and write
B8D000
trusted library allocation
page execute and read and write
15CE000
stack
page read and write
5F0E000
stack
page read and write
6F9000
stack
page read and write
5E9D000
stack
page read and write
240B000
trusted library allocation
page execute and read and write
191E000
heap
page read and write
2B50000
heap
page execute and read and write
62C0000
trusted library allocation
page execute and read and write
11A3000
trusted library allocation
page execute and read and write
B83000
trusted library allocation
page execute and read and write
600E000
stack
page read and write
196C000
heap
page read and write
11DB000
trusted library allocation
page execute and read and write
1210000
trusted library allocation
page read and write
C57000
heap
page read and write
4B12000
trusted library allocation
page read and write
1020000
heap
page read and write
60DE000
stack
page read and write
184B000
heap
page read and write
605D000
stack
page read and write
2B61000
trusted library allocation
page read and write
2781000
trusted library allocation
page read and write
2970000
heap
page read and write
15DB000
stack
page read and write
193D000
heap
page read and write
18F000
unkown
page readonly
52FE000
stack
page read and write
C58000
heap
page read and write
860000
heap
page read and write
3B0000
system
page execute and read and write
1240000
heap
page read and write
546F000
stack
page read and write
AC0000
heap
page read and write
CC2000
heap
page read and write
52BE000
stack
page read and write
11BD000
trusted library allocation
page execute and read and write
449E000
direct allocation
page read and write
9A9000
heap
page read and write
5D9E000
stack
page read and write
1900000
heap
page read and write
C42000
trusted library allocation
page read and write
7D0000
heap
page read and write
593E000
heap
page read and write
184B000
heap
page read and write
2405000
trusted library allocation
page execute and read and write
442D000
direct allocation
page read and write
5C5E000
stack
page read and write
1049000
heap
page read and write
C2D000
trusted library allocation
page execute and read and write
192E000
heap
page read and write
There are 336 hidden memdumps, click here to show them.