Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
3z5nZg91qJ.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\aut4479.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut44F7.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\piceworth
|
ASCII text, with very long lines (28756), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\starbright
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\3z5nZg91qJ.exe
|
"C:\Users\user\Desktop\3z5nZg91qJ.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\3z5nZg91qJ.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://api.ipify.org/
|
172.67.74.152
|
||
|
https://api.ipify.org
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
https://api.ipify.org/t
|
unknown
|
||
|
http://mail.fasmacopy.gr
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
mail.fasmacopy.gr
|
79.170.44.32
|
|
|
|
api.ipify.org
|
172.67.74.152
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
79.170.44.32
|
mail.fasmacopy.gr
|
United Kingdom
|
|
|
|
172.67.74.152
|
api.ipify.org
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
5090000
|
trusted library section
|
page read and write
|
|
|
|
2C8F000
|
trusted library allocation
|
page read and write
|
|
|
|
3C11000
|
trusted library allocation
|
page read and write
|
|
|
|
2C64000
|
trusted library allocation
|
page read and write
|
|
|
|
270E000
|
heap
|
page read and write
|
|
|
|
5120000
|
trusted library section
|
page read and write
|
|
|
|
C34000
|
trusted library allocation
|
page read and write
|
||
|
6B30000
|
heap
|
page read and write
|
||
|
AF0000
|
unkown
|
page readonly
|
||
|
2C53000
|
trusted library allocation
|
page read and write
|
||
|
6770000
|
trusted library allocation
|
page read and write
|
||
|
E48000
|
heap
|
page read and write
|
||
|
3670000
|
direct allocation
|
page read and write
|
||
|
DB4000
|
heap
|
page read and write
|
||
|
55C8000
|
heap
|
page read and write
|
||
|
581D000
|
trusted library allocation
|
page read and write
|
||
|
BF8000
|
unkown
|
page readonly
|
||
|
6AEE000
|
stack
|
page read and write
|
||
|
3620000
|
direct allocation
|
page read and write
|
||
|
DC0000
|
heap
|
page read and write
|
||
|
2805000
|
trusted library allocation
|
page execute and read and write
|
||
|
2A20000
|
trusted library allocation
|
page read and write
|
||
|
29C4000
|
heap
|
page read and write
|
||
|
2990000
|
trusted library allocation
|
page execute and read and write
|
||
|
DC8000
|
heap
|
page read and write
|
||
|
64AF000
|
stack
|
page read and write
|
||
|
2A10000
|
trusted library allocation
|
page read and write
|
||
|
2A58000
|
trusted library allocation
|
page read and write
|
||
|
BB8000
|
unkown
|
page readonly
|
||
|
297E000
|
stack
|
page read and write
|
||
|
EA0000
|
heap
|
page read and write
|
||
|
E51000
|
heap
|
page read and write
|
||
|
2C97000
|
trusted library allocation
|
page read and write
|
||
|
5180000
|
heap
|
page execute and read and write
|
||
|
69EE000
|
stack
|
page read and write
|
||
|
1AB0000
|
heap
|
page read and write
|
||
|
AF0000
|
unkown
|
page readonly
|
||
|
6B60000
|
heap
|
page read and write
|
||
|
39AE000
|
direct allocation
|
page read and write
|
||
|
6777000
|
trusted library allocation
|
page read and write
|
||
|
38ED000
|
direct allocation
|
page read and write
|
||
|
B75000
|
heap
|
page read and write
|
||
|
2827000
|
heap
|
page read and write
|
||
|
393D000
|
direct allocation
|
page read and write
|
||
|
CCE000
|
stack
|
page read and write
|
||
|
B20000
|
heap
|
page read and write
|
||
|
BAF000
|
unkown
|
page read and write
|
||
|
2C60000
|
trusted library allocation
|
page read and write
|
||
|
DF6000
|
heap
|
page read and write
|
||
|
3C0000
|
heap
|
page read and write
|
||
|
2A30000
|
trusted library allocation
|
page read and write
|
||
|
5112000
|
trusted library allocation
|
page read and write
|
||
|
50FE000
|
trusted library allocation
|
page read and write
|
||
|
6634000
|
trusted library allocation
|
page read and write
|
||
|
696E000
|
stack
|
page read and write
|
||
|
39AE000
|
direct allocation
|
page read and write
|
||
|
19BF000
|
stack
|
page read and write
|
||
|
E62000
|
heap
|
page read and write
|
||
|
B70000
|
heap
|
page read and write
|
||
|
55DA000
|
heap
|
page read and write
|
||
|
C33000
|
trusted library allocation
|
page execute and read and write
|
||
|
C50000
|
heap
|
page read and write
|
||
|
E9F000
|
heap
|
page read and write
|
||
|
27F2000
|
trusted library allocation
|
page read and write
|
||
|
3939000
|
direct allocation
|
page read and write
|
||
|
65EE000
|
stack
|
page read and write
|
||
|
2C8D000
|
trusted library allocation
|
page read and write
|
||
|
E4E000
|
stack
|
page read and write
|
||
|
2802000
|
trusted library allocation
|
page read and write
|
||
|
5830000
|
trusted library allocation
|
page execute and read and write
|
||
|
A00000
|
heap
|
page read and write
|
||
|
5518000
|
heap
|
page read and write
|
||
|
6780000
|
trusted library allocation
|
page execute and read and write
|
||
|
699000
|
stack
|
page read and write
|
||
|
37C0000
|
direct allocation
|
page read and write
|
||
|
3CD3000
|
trusted library allocation
|
page read and write
|
||
|
1085000
|
heap
|
page read and write
|
||
|
BBC000
|
unkown
|
page readonly
|
||
|
C4D000
|
trusted library allocation
|
page execute and read and write
|
||
|
D4C000
|
heap
|
page read and write
|
||
|
B7F000
|
unkown
|
page readonly
|
||
|
54EC000
|
stack
|
page read and write
|
||
|
AF1000
|
unkown
|
page execute read
|
||
|
2A0C000
|
stack
|
page read and write
|
||
|
C20000
|
trusted library allocation
|
page read and write
|
||
|
C43000
|
trusted library allocation
|
page read and write
|
||
|
5290000
|
trusted library allocation
|
page read and write
|
||
|
BAF000
|
unkown
|
page write copy
|
||
|
3810000
|
direct allocation
|
page read and write
|
||
|
E50000
|
heap
|
page read and write
|
||
|
50E0000
|
trusted library allocation
|
page read and write
|
||
|
3939000
|
direct allocation
|
page read and write
|
||
|
672E000
|
stack
|
page read and write
|
||
|
4D0D000
|
stack
|
page read and write
|
||
|
3743000
|
direct allocation
|
page read and write
|
||
|
6628000
|
trusted library allocation
|
page read and write
|
||
|
2800000
|
trusted library allocation
|
page read and write
|
||
|
CE1000
|
heap
|
page read and write
|
||
|
393D000
|
direct allocation
|
page read and write
|
||
|
BB3000
|
unkown
|
page write copy
|
||
|
DFB000
|
heap
|
page read and write
|
||
|
BF0000
|
heap
|
page read and write
|
||
|
AF1000
|
unkown
|
page execute read
|
||
|
E9F000
|
heap
|
page read and write
|
||
|
5101000
|
trusted library allocation
|
page read and write
|
||
|
DF1000
|
heap
|
page read and write
|
||
|
7FD90000
|
trusted library allocation
|
page execute and read and write
|
||
|
280B000
|
trusted library allocation
|
page execute and read and write
|
||
|
9FC000
|
stack
|
page read and write
|
||
|
395E000
|
direct allocation
|
page read and write
|
||
|
F76000
|
heap
|
page read and write
|
||
|
2CA9000
|
trusted library allocation
|
page read and write
|
||
|
3793000
|
direct allocation
|
page read and write
|
||
|
BA5000
|
unkown
|
page readonly
|
||
|
37C0000
|
direct allocation
|
page read and write
|
||
|
3D0000
|
heap
|
page read and write
|
||
|
50F2000
|
trusted library allocation
|
page read and write
|
||
|
9CF000
|
stack
|
page read and write
|
||
|
B6E000
|
stack
|
page read and write
|
||
|
3670000
|
direct allocation
|
page read and write
|
||
|
3939000
|
direct allocation
|
page read and write
|
||
|
1029000
|
heap
|
page read and write
|
||
|
C40000
|
trusted library allocation
|
page read and write
|
||
|
27FA000
|
trusted library allocation
|
page execute and read and write
|
||
|
C10000
|
trusted library section
|
page read and write
|
||
|
3810000
|
direct allocation
|
page read and write
|
||
|
E80000
|
heap
|
page read and write
|
||
|
DB0000
|
heap
|
page read and write
|
||
|
C30000
|
trusted library allocation
|
page read and write
|
||
|
EB2000
|
heap
|
page read and write
|
||
|
E70000
|
heap
|
page read and write
|
||
|
2C11000
|
trusted library allocation
|
page read and write
|
||
|
63AE000
|
stack
|
page read and write
|
||
|
349000
|
stack
|
page read and write
|
||
|
445000
|
system
|
page execute and read and write
|
||
|
6640000
|
trusted library allocation
|
page execute and read and write
|
||
|
F9E000
|
heap
|
page read and write
|
||
|
C8D000
|
heap
|
page read and write
|
||
|
27F0000
|
trusted library allocation
|
page read and write
|
||
|
510D000
|
trusted library allocation
|
page read and write
|
||
|
29C0000
|
heap
|
page read and write
|
||
|
426000
|
system
|
page execute and read and write
|
||
|
CB4000
|
heap
|
page read and write
|
||
|
DF3000
|
heap
|
page read and write
|
||
|
BD0000
|
trusted library section
|
page read and write
|
||
|
508E000
|
stack
|
page read and write
|
||
|
3D14000
|
trusted library allocation
|
page read and write
|
||
|
50EE000
|
trusted library allocation
|
page read and write
|
||
|
C58000
|
heap
|
page read and write
|
||
|
692D000
|
stack
|
page read and write
|
||
|
3670000
|
direct allocation
|
page read and write
|
||
|
15BD000
|
stack
|
page read and write
|
||
|
38ED000
|
direct allocation
|
page read and write
|
||
|
3743000
|
direct allocation
|
page read and write
|
||
|
D0E000
|
stack
|
page read and write
|
||
|
3793000
|
direct allocation
|
page read and write
|
||
|
676E000
|
stack
|
page read and write
|
||
|
3B0000
|
heap
|
page read and write
|
||
|
38ED000
|
direct allocation
|
page read and write
|
||
|
64EE000
|
stack
|
page read and write
|
||
|
ED1000
|
heap
|
page read and write
|
||
|
6630000
|
trusted library allocation
|
page read and write
|
||
|
5810000
|
trusted library allocation
|
page read and write
|
||
|
38E9000
|
direct allocation
|
page read and write
|
||
|
69AF000
|
stack
|
page read and write
|
||
|
1AE0000
|
direct allocation
|
page read and write
|
||
|
39AE000
|
direct allocation
|
page read and write
|
||
|
53EC000
|
stack
|
page read and write
|
||
|
BBC000
|
unkown
|
page readonly
|
||
|
2C0E000
|
stack
|
page read and write
|
||
|
798000
|
stack
|
page read and write
|
||
|
2930000
|
trusted library allocation
|
page read and write
|
||
|
38E9000
|
direct allocation
|
page read and write
|
||
|
5820000
|
heap
|
page read and write
|
||
|
BA5000
|
unkown
|
page readonly
|
||
|
FE0000
|
heap
|
page read and write
|
||
|
B1E000
|
stack
|
page read and write
|
||
|
2C4A000
|
trusted library allocation
|
page read and write
|
||
|
1B30000
|
heap
|
page read and write
|
||
|
BE0000
|
heap
|
page read and write
|
||
|
2C8B000
|
trusted library allocation
|
page read and write
|
||
|
50EB000
|
trusted library allocation
|
page read and write
|
||
|
C3D000
|
trusted library allocation
|
page execute and read and write
|
||
|
DFB000
|
heap
|
page read and write
|
||
|
1089000
|
heap
|
page read and write
|
||
|
CFD000
|
heap
|
page read and write
|
||
|
6AF0000
|
trusted library allocation
|
page read and write
|
||
|
393D000
|
direct allocation
|
page read and write
|
||
|
395E000
|
direct allocation
|
page read and write
|
||
|
2A40000
|
heap
|
page read and write
|
||
|
6B00000
|
trusted library allocation
|
page read and write
|
||
|
5552000
|
heap
|
page read and write
|
||
|
3810000
|
direct allocation
|
page read and write
|
||
|
E80000
|
heap
|
page read and write
|
||
|
9BF000
|
stack
|
page read and write
|
||
|
F4E000
|
stack
|
page read and write
|
||
|
6650000
|
trusted library allocation
|
page read and write
|
||
|
C8B000
|
heap
|
page read and write
|
||
|
52B0000
|
heap
|
page read and write
|
||
|
395E000
|
direct allocation
|
page read and write
|
||
|
37C0000
|
direct allocation
|
page read and write
|
||
|
E80000
|
heap
|
page read and write
|
||
|
B7F000
|
unkown
|
page readonly
|
||
|
3793000
|
direct allocation
|
page read and write
|
||
|
2CA3000
|
trusted library allocation
|
page read and write
|
||
|
9DB000
|
stack
|
page read and write
|
||
|
29A0000
|
trusted library allocation
|
page read and write
|
||
|
2807000
|
trusted library allocation
|
page execute and read and write
|
||
|
2980000
|
heap
|
page read and write
|
||
|
5106000
|
trusted library allocation
|
page read and write
|
||
|
2820000
|
heap
|
page read and write
|
||
|
2CA7000
|
trusted library allocation
|
page read and write
|
||
|
BF8000
|
unkown
|
page readonly
|
||
|
38E9000
|
direct allocation
|
page read and write
|
||
|
3620000
|
direct allocation
|
page read and write
|
||
|
3620000
|
direct allocation
|
page read and write
|
||
|
1099000
|
heap
|
page read and write
|
||
|
BB8000
|
unkown
|
page readonly
|
||
|
6B80000
|
trusted library allocation
|
page execute and read and write
|
||
|
6620000
|
trusted library allocation
|
page read and write
|
||
|
1AD0000
|
direct allocation
|
page execute and read and write
|
||
|
2B00000
|
heap
|
page execute and read and write
|
||
|
528E000
|
stack
|
page read and write
|
||
|
2CA5000
|
trusted library allocation
|
page read and write
|
||
|
CB8000
|
heap
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
669D000
|
stack
|
page read and write
|
||
|
27F6000
|
trusted library allocation
|
page execute and read and write
|
||
|
3743000
|
direct allocation
|
page read and write
|
||
|
5510000
|
heap
|
page read and write
|
There are 220 hidden memdumps, click here to show them.