IOC Report
whiteee.exe

loading gif

Files

File Path
Type
Category
Malicious
whiteee.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\aut7961.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut7991.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\eupolyzoan
ASCII text, with very long lines (28680), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\horrify
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\whiteee.exe
"C:\Users\user\Desktop\whiteee.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\whiteee.exe"
 malicious

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
193.122.6.168
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.97.3
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.97.3
 malicious
checkip.dyndns.org
unknown
 malicious
56.126.166.20.in-addr.arpa
unknown
 malicious
checkip.dyndns.com
193.122.6.168

IPs

IP
Domain
Country
Malicious
188.114.97.3
reallyfreegeoip.org
European Union
malicious
193.122.6.168
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2B11000
trusted library allocation
page read and write
 malicious
1100000
direct allocation
page read and write
 malicious
2CE0000
trusted library allocation
page read and write
 malicious
402000
system
page execute and read and write
 malicious
117F000
heap
page read and write
3D49000
direct allocation
page read and write
6650000
heap
page read and write
575E000
trusted library allocation
page read and write
43C000
unkown
page write copy
121F000
heap
page read and write
3D4D000
direct allocation
page read and write
117F000
heap
page read and write
2BBB000
trusted library allocation
page read and write
FE0000
heap
page read and write
5750000
trusted library allocation
page read and write
63CE000
stack
page read and write
1175000
heap
page read and write
40C000
unkown
page readonly
1174000
heap
page read and write
370000
unkown
page readonly
2C5E000
trusted library allocation
page read and write
1184000
heap
page read and write
EF0000
heap
page read and write
400000
system
page execute and read and write
1175000
heap
page read and write
1E90000
heap
page read and write
1162000
heap
page read and write
612F000
heap
page read and write
100E000
stack
page read and write
3D4D000
direct allocation
page read and write
120F000
heap
page read and write
3C20000
direct allocation
page read and write
3D49000
direct allocation
page read and write
2C12000
trusted library allocation
page read and write
192E000
stack
page read and write
2D4E000
trusted library allocation
page read and write
1000000
trusted library allocation
page read and write
C10000
heap
page read and write
654F000
stack
page read and write
1130000
heap
page read and write
3B7C000
trusted library allocation
page read and write
444000
unkown
page readonly
DED000
trusted library allocation
page execute and read and write
2AE1000
trusted library allocation
page read and write
4FF0000
trusted library allocation
page read and write
640E000
stack
page read and write
2AC6000
trusted library allocation
page read and write
3DBE000
direct allocation
page read and write
DD0000
trusted library allocation
page read and write
1EA0000
heap
page read and write
2AE6000
trusted library allocation
page read and write
3BA3000
trusted library allocation
page read and write
2ACE000
trusted library allocation
page read and write
6630000
heap
page read and write
3B39000
trusted library allocation
page read and write
2CC0000
trusted library allocation
page read and write
2C62000
trusted library allocation
page read and write
6670000
trusted library allocation
page execute and read and write
11D2000
heap
page read and write
3DBE000
direct allocation
page read and write
3D49000
direct allocation
page read and write
E8A000
heap
page read and write
2CD3000
trusted library allocation
page read and write
121F000
heap
page read and write
2D62000
trusted library allocation
page read and write
3DBE000
direct allocation
page read and write
6573000
trusted library allocation
page read and write
DF6000
trusted library allocation
page execute and read and write
657A000
trusted library allocation
page read and write
117F000
heap
page read and write
EC0000
heap
page read and write
655B000
trusted library allocation
page read and write
2C97000
trusted library allocation
page read and write
A8A000
stack
page read and write
3BA3000
direct allocation
page read and write
120F000
heap
page read and write
6550000
trusted library allocation
page read and write
10D0000
heap
page read and write
DFA000
trusted library allocation
page execute and read and write
DD4000
trusted library allocation
page read and write
370000
unkown
page readonly
5000000
trusted library allocation
page read and write
51A3000
heap
page read and write
65B0000
trusted library allocation
page read and write
6610000
trusted library allocation
page read and write
121F000
heap
page read and write
2AF2000
trusted library allocation
page read and write
644E000
stack
page read and write
3BA3000
direct allocation
page read and write
1165000
heap
page read and write
3D4D000
direct allocation
page read and write
5740000
trusted library allocation
page execute and read and write
60CE000
stack
page read and write
2BDB000
trusted library allocation
page read and write
E68000
heap
page read and write
DC0000
trusted library allocation
page read and write
2BD8000
trusted library allocation
page read and write
54EE000
stack
page read and write
11D2000
heap
page read and write
440000
unkown
page write copy
11D2000
heap
page read and write
3A80000
direct allocation
page read and write
628E000
stack
page read and write
117F000
heap
page read and write
2C52000
trusted library allocation
page read and write
2C08000
trusted library allocation
page read and write
115B000
heap
page read and write
11EF000
heap
page read and write
2DA5000
trusted library allocation
page read and write
2C6E000
trusted library allocation
page read and write
E8F000
stack
page read and write
3D49000
direct allocation
page read and write
432000
unkown
page readonly
6590000
trusted library allocation
page execute and read and write
638E000
stack
page read and write
11D2000
heap
page read and write
3A80000
direct allocation
page read and write
5050000
heap
page execute and read and write
E6B000
stack
page read and write
371000
unkown
page execute read
DF2000
trusted library allocation
page read and write
65A0000
trusted library allocation
page read and write
620E000
stack
page read and write
2ACB000
trusted library allocation
page read and write
1175000
heap
page read and write
371000
unkown
page execute read
3C20000
direct allocation
page read and write
2AED000
trusted library allocation
page read and write
1163000
heap
page read and write
E9C000
heap
page read and write
657F000
trusted library allocation
page read and write
ECA000
heap
page read and write
3A80000
direct allocation
page read and write
2BF3000
trusted library allocation
page read and write
3BA3000
direct allocation
page read and write
EDC000
heap
page read and write
121F000
heap
page read and write
E50000
heap
page read and write
6580000
trusted library allocation
page execute and read and write
3D49000
direct allocation
page read and write
2CA5000
trusted library allocation
page read and write
1153000
heap
page read and write
3D4D000
direct allocation
page read and write
2C0A000
trusted library allocation
page read and write
1174000
heap
page read and write
3C20000
direct allocation
page read and write
432000
unkown
page readonly
2C1A000
trusted library allocation
page read and write
E05000
trusted library allocation
page execute and read and write
3C20000
direct allocation
page read and write
3D4D000
direct allocation
page read and write
11DF000
heap
page read and write
6138000
heap
page read and write
3DBE000
direct allocation
page read and write
2ABE000
stack
page read and write
117F000
heap
page read and write
2D75000
trusted library allocation
page read and write
E4F000
stack
page read and write
8AA000
stack
page read and write
E5E000
stack
page read and write
121E000
stack
page read and write
2C1E000
trusted library allocation
page read and write
D30000
heap
page read and write
509D000
stack
page read and write
2D53000
trusted library allocation
page read and write
2C5A000
trusted library allocation
page read and write
3BA3000
direct allocation
page read and write
11D2000
heap
page read and write
40C000
unkown
page readonly
43C000
unkown
page read and write
E0B000
trusted library allocation
page execute and read and write
2C6A000
trusted library allocation
page read and write
104E000
stack
page read and write
E60000
heap
page read and write
DDD000
trusted library allocation
page execute and read and write
4CAE000
stack
page read and write
2ADA000
trusted library allocation
page read and write
3DBE000
direct allocation
page read and write
2C66000
trusted library allocation
page read and write
2AC0000
trusted library allocation
page read and write
2C16000
trusted library allocation
page read and write
DF0000
trusted library allocation
page read and write
D2E000
stack
page read and write
6560000
trusted library allocation
page execute and read and write
624E000
stack
page read and write
117F000
heap
page read and write
2B00000
heap
page execute and read and write
60DE000
heap
page read and write
3A80000
direct allocation
page read and write
3C20000
direct allocation
page read and write
E40000
heap
page read and write
2DAB000
trusted library allocation
page read and write
117F000
heap
page read and write
3D49000
direct allocation
page read and write
E7E000
heap
page read and write
613E000
heap
page read and write
2C89000
trusted library allocation
page read and write
10F0000
direct allocation
page execute and read and write
1E94000
heap
page read and write
5020000
trusted library allocation
page read and write
D7E000
stack
page read and write
6556000
trusted library allocation
page read and write
6570000
trusted library allocation
page read and write
3BA3000
direct allocation
page read and write
60D0000
heap
page read and write
115B000
heap
page read and write
3DBE000
direct allocation
page read and write
DE0000
trusted library allocation
page read and write
120F000
heap
page read and write
2ADE000
trusted library allocation
page read and write
3B11000
trusted library allocation
page read and write
2CC4000
trusted library allocation
page read and write
DD3000
trusted library allocation
page execute and read and write
2C56000
trusted library allocation
page read and write
E07000
trusted library allocation
page execute and read and write
6558000
trusted library allocation
page read and write
2D59000
trusted library allocation
page read and write
2D6C000
trusted library allocation
page read and write
3A80000
direct allocation
page read and write
117F000
heap
page read and write
51A0000
heap
page read and write
122F000
heap
page read and write
615D000
heap
page read and write
6123000
heap
page read and write
2BCF000
trusted library allocation
page read and write
444000
unkown
page readonly
3C20000
direct allocation
page read and write
1D2E000
stack
page read and write
1010000
heap
page read and write
10B0000
heap
page read and write
E02000
trusted library allocation
page read and write
60FE000
heap
page read and write
117F000
heap
page read and write
11F0000
heap
page read and write
60F4000
heap
page read and write
117C000
heap
page read and write
11EF000
heap
page read and write
117F000
heap
page read and write
2D99000
trusted library allocation
page read and write
11FC000
heap
page read and write
3BAC000
trusted library allocation
page read and write
2BCC000
trusted library allocation
page read and write
DA5000
heap
page read and write
1138000
heap
page read and write
2C7B000
trusted library allocation
page read and write
1174000
heap
page read and write
11DF000
heap
page read and write
DA0000
heap
page read and write
3D4D000
direct allocation
page read and write
FDD000
stack
page read and write
3A80000
direct allocation
page read and write
11F0000
heap
page read and write
117F000
heap
page read and write
1165000
heap
page read and write
5FCE000
stack
page read and write
3B96000
trusted library allocation
page read and write
E30000
trusted library allocation
page execute and read and write
3BA3000
direct allocation
page read and write
2BC3000
trusted library allocation
page read and write
2D9F000
trusted library allocation
page read and write
E7F000
stack
page read and write
F9E000
stack
page read and write
111F000
stack
page read and write
3BA0000
trusted library allocation
page read and write
11D2000
heap
page read and write
5730000
trusted library allocation
page read and write
9A7000
stack
page read and write
51B0000
heap
page read and write
2D71000
trusted library allocation
page read and write
1050000
heap
page read and write
There are 260 hidden memdumps, click here to show them.