IOC Report
DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe

loading gif

Files

File Path
Type
Category
Malicious
DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KaGeys.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\asset
data
dropped
C:\Users\user\AppData\Local\Temp\autC01D.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\autC05C.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\tapestring
ASCII text, with very long lines (28756), with no line terminators
dropped
C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
modified
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe
"C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe"
 malicious
C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe
"C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe"
malicious
C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe
"C:\Users\user\AppData\Roaming\KaGeys\KaGeys.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.13.205
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
http://mail.laboratoriosvilla.com.mx
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://ip-api.com
unknown
http://r10.o.lencr.org0#
unknown
http://laboratoriosvilla.com.mx
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://r10.i.lencr.org/0
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
There are 3 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
laboratoriosvilla.com.mx
216.194.161.167
 malicious
ip-api.com
208.95.112.1
 malicious
mail.laboratoriosvilla.com.mx
unknown
 malicious
api.ipify.org
104.26.13.205

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
malicious
216.194.161.167
laboratoriosvilla.com.mx
United States
malicious
104.26.13.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
KaGeys
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2A63000
trusted library allocation
page read and write
 malicious
2A25000
trusted library allocation
page read and write
 malicious
1120000
direct allocation
page read and write
 malicious
402000
system
page execute and read and write
 malicious
2A4D000
trusted library allocation
page read and write
 malicious
64D0000
trusted library allocation
page read and write
EA0000
unkown
page readonly
FE0000
trusted library allocation
page read and write
1350000
heap
page read and write
2A68000
trusted library allocation
page read and write
28B0000
heap
page read and write
601D000
stack
page read and write
4E3C000
stack
page read and write
3C63000
direct allocation
page read and write
13C5000
heap
page read and write
CDB000
trusted library allocation
page execute and read and write
DCF000
stack
page read and write
E02000
unkown
page readonly
66EE000
stack
page read and write
CB0000
trusted library allocation
page read and write
2A4B000
trusted library allocation
page read and write
119A000
heap
page read and write
C6F000
stack
page read and write
835000
heap
page read and write
4F30000
heap
page read and write
DAE000
heap
page read and write
11DF000
heap
page read and write
12ED000
heap
page read and write
880000
trusted library allocation
page read and write
11EA000
heap
page read and write
DBA000
heap
page read and write
F2F000
unkown
page readonly
E0A000
unkown
page readonly
EA1000
unkown
page execute read
87E000
stack
page read and write
CD5000
trusted library allocation
page execute and read and write
F63000
unkown
page write copy
1E90000
heap
page read and write
3E0000
heap
page read and write
8B0000
trusted library allocation
page read and write
3E09000
direct allocation
page read and write
E78000
heap
page read and write
4AB0000
trusted library allocation
page execute and read and write
8A0000
heap
page read and write
894000
trusted library allocation
page read and write
4ABE000
stack
page read and write
37F4000
heap
page read and write
2860000
trusted library allocation
page read and write
CA3000
trusted library allocation
page execute and read and write
3E09000
direct allocation
page read and write
1259000
heap
page read and write
950000
trusted library allocation
page read and write
89D000
trusted library allocation
page execute and read and write
1208000
heap
page read and write
64B0000
trusted library allocation
page read and write
13C0000
heap
page read and write
FD0000
trusted library allocation
page read and write
57EE000
stack
page read and write
CF0000
heap
page read and write
2892000
trusted library allocation
page read and write
3E09000
direct allocation
page read and write
1110000
direct allocation
page execute and read and write
119A000
heap
page read and write
2F60000
trusted library allocation
page execute and read and write
930000
heap
page read and write
F55000
unkown
page readonly
B95000
heap
page read and write
2F70000
heap
page read and write
3E0D000
direct allocation
page read and write
3CE0000
direct allocation
page read and write
CA0000
trusted library allocation
page read and write
2FF0000
heap
page read and write
3E7E000
direct allocation
page read and write
11DE000
heap
page read and write
3B40000
direct allocation
page read and write
4B7E000
stack
page read and write
F8E000
stack
page read and write
CD7000
trusted library allocation
page execute and read and write
E00000
unkown
page readonly
2A49000
trusted library allocation
page read and write
4E3F000
stack
page read and write
DDB000
stack
page read and write
5EDE000
stack
page read and write
17AC000
stack
page read and write
2850000
heap
page execute and read and write
11EB000
heap
page read and write
CC2000
trusted library allocation
page read and write
3160000
heap
page execute and read and write
2A0D000
trusted library allocation
page read and write
8B4000
trusted library allocation
page read and write
E88000
heap
page read and write
244E000
stack
page read and write
530E000
stack
page read and write
3C63000
direct allocation
page read and write
16E0000
trusted library allocation
page read and write
1707000
trusted library allocation
page execute and read and write
5C43000
heap
page read and write
13B3000
trusted library allocation
page execute and read and write
3C63000
direct allocation
page read and write
1288000
heap
page read and write
27A8000
trusted library allocation
page read and write
63E7000
trusted library allocation
page read and write
3E0D000
direct allocation
page read and write
E52000
heap
page read and write
29BF000
stack
page read and write
2A76000
trusted library allocation
page read and write
3B40000
direct allocation
page read and write
134E000
stack
page read and write
DBF000
stack
page read and write
3E0D000
direct allocation
page read and write
39E9000
trusted library allocation
page read and write
3CE0000
direct allocation
page read and write
AFE000
stack
page read and write
596E000
stack
page read and write
513C000
stack
page read and write
3171000
trusted library allocation
page read and write
910000
trusted library allocation
page read and write
12CE000
heap
page read and write
617F000
stack
page read and write
3E7E000
direct allocation
page read and write
11EA000
heap
page read and write
2FE0000
trusted library allocation
page execute and read and write
63DD000
trusted library allocation
page read and write
263F000
stack
page read and write
36C000
stack
page read and write
920000
heap
page read and write
1238000
heap
page read and write
10E0000
heap
page read and write
DC8000
heap
page read and write
39C1000
trusted library allocation
page read and write
11C3000
heap
page read and write
F5F000
unkown
page write copy
DC5000
heap
page read and write
978000
heap
page read and write
D00000
trusted library allocation
page read and write
6500000
heap
page read and write
1240000
heap
page read and write
119F000
heap
page read and write
8DB000
trusted library allocation
page execute and read and write
252C000
stack
page read and write
12ED000
heap
page read and write
473E000
stack
page read and write
4F3F000
stack
page read and write
1183000
heap
page read and write
12DE000
heap
page read and write
CCA000
trusted library allocation
page execute and read and write
6440000
trusted library allocation
page read and write
B80000
trusted library allocation
page read and write
F68000
unkown
page readonly
4BFE000
stack
page read and write
6FA000
stack
page read and write
592F000
stack
page read and write
3CE0000
direct allocation
page read and write
12FB000
heap
page read and write
D90000
heap
page read and write
FB0000
trusted library allocation
page execute and read and write
3B40000
direct allocation
page read and write
1247000
heap
page read and write
3E09000
direct allocation
page read and write
79A000
stack
page read and write
830000
heap
page read and write
994000
heap
page read and write
1300000
heap
page read and write
582E000
stack
page read and write
CC0000
trusted library allocation
page read and write
1160000
heap
page read and write
6530000
trusted library allocation
page execute and read and write
99A000
heap
page read and write
624E000
stack
page read and write
11CE000
heap
page read and write
64B7000
trusted library allocation
page read and write
1192000
heap
page read and write
130F000
heap
page read and write
13B4000
trusted library allocation
page read and write
6450000
trusted library allocation
page execute and read and write
3E7E000
direct allocation
page read and write
4F40000
heap
page read and write
5BA0000
heap
page read and write
6850000
heap
page read and write
4EE0000
heap
page execute and read and write
29C1000
trusted library allocation
page read and write
2866000
trusted library allocation
page read and write
CAD000
trusted library allocation
page execute and read and write
4F33000
heap
page read and write
12CF000
heap
page read and write
F68000
unkown
page readonly
893000
trusted library allocation
page execute and read and write
C9F000
stack
page read and write
2F90000
trusted library allocation
page read and write
119F000
heap
page read and write
7F240000
trusted library allocation
page execute and read and write
3A2B000
trusted library allocation
page read and write
3E0D000
direct allocation
page read and write
11EA000
heap
page read and write
130E000
heap
page read and write
16DE000
stack
page read and write
3641000
trusted library allocation
page read and write
63D0000
trusted library allocation
page read and write
29FF000
trusted library allocation
page read and write
E00000
heap
page read and write
63CE000
stack
page read and write
638E000
stack
page read and write
12C1000
heap
page read and write
29F5000
trusted library allocation
page read and write
80E000
stack
page read and write
3E0D000
direct allocation
page read and write
F55000
unkown
page readonly
130D000
heap
page read and write
121F000
heap
page read and write
287A000
trusted library allocation
page read and write
3E7E000
direct allocation
page read and write
9A7000
heap
page read and write
17B0000
heap
page read and write
64C0000
trusted library allocation
page read and write
4C30000
heap
page execute and read and write
8BD000
trusted library allocation
page execute and read and write
11EA000
heap
page read and write
3D0000
heap
page read and write
4D3E000
stack
page read and write
54CD000
stack
page read and write
1192000
heap
page read and write
9DD000
heap
page read and write
56E0000
heap
page execute and read and write
54D0000
trusted library allocation
page read and write
E90000
heap
page read and write
E14000
heap
page read and write
979000
stack
page read and write
288D000
trusted library allocation
page read and write
FF0000
heap
page read and write
3C63000
direct allocation
page read and write
D98000
heap
page read and write
170B000
trusted library allocation
page execute and read and write
3C63000
direct allocation
page read and write
12DE000
heap
page read and write
2881000
trusted library allocation
page read and write
F9A000
stack
page read and write
6430000
trusted library allocation
page execute and read and write
DFC000
stack
page read and write
FC0000
trusted library allocation
page read and write
3C63000
direct allocation
page read and write
400000
system
page execute and read and write
1168000
heap
page read and write
1380000
heap
page read and write
642E000
stack
page read and write
1200000
heap
page read and write
5A6E000
stack
page read and write
98F000
heap
page read and write
CA4000
trusted library allocation
page read and write
2641000
trusted library allocation
page read and write
4BBE000
stack
page read and write
87A000
stack
page read and write
10F0000
heap
page read and write
56AE000
stack
page read and write
E4E000
stack
page read and write
159E000
stack
page read and write
120A000
heap
page read and write
F2F000
unkown
page readonly
122B000
heap
page read and write
1224000
heap
page read and write
11EA000
heap
page read and write
900000
trusted library allocation
page execute and read and write
960000
heap
page read and write
11BE000
heap
page read and write
3E7E000
direct allocation
page read and write
F90000
heap
page read and write
5BC9000
heap
page read and write
119F000
heap
page read and write
B6F000
stack
page read and write
FF6000
heap
page read and write
B90000
heap
page read and write
12DF000
heap
page read and write
8D7000
trusted library allocation
page execute and read and write
D8C000
stack
page read and write
E8E000
stack
page read and write
54D9000
trusted library allocation
page read and write
16ED000
trusted library allocation
page execute and read and write
D4E000
stack
page read and write
CC6000
trusted library allocation
page execute and read and write
9E0000
heap
page read and write
EA1000
unkown
page execute read
3CE0000
direct allocation
page read and write
3B40000
direct allocation
page read and write
11EA000
heap
page read and write
15DE000
stack
page read and write
11EA000
heap
page read and write
1700000
trusted library allocation
page read and write
176E000
stack
page read and write
3B40000
direct allocation
page read and write
634E000
stack
page read and write
63E0000
trusted library allocation
page read and write
2FA0000
trusted library allocation
page read and write
30FE000
stack
page read and write
3CE0000
direct allocation
page read and write
16E4000
trusted library allocation
page read and write
11CE000
heap
page read and write
54E0000
heap
page read and write
3E7E000
direct allocation
page read and write
11EA000
heap
page read and write
286E000
trusted library allocation
page read and write
CBD000
trusted library allocation
page execute and read and write
2530000
heap
page execute and read and write
1D5E000
stack
page read and write
1193000
heap
page read and write
3B40000
direct allocation
page read and write
13A0000
trusted library allocation
page read and write
CD2000
trusted library allocation
page read and write
11BE000
heap
page read and write
13BD000
trusted library allocation
page execute and read and write
B4E000
stack
page read and write
620F000
stack
page read and write
11DE000
heap
page read and write
3CE0000
direct allocation
page read and write
970000
heap
page read and write
4171000
trusted library allocation
page read and write
287E000
trusted library allocation
page read and write
EA0000
unkown
page readonly
F5F000
unkown
page read and write
11EA000
heap
page read and write
5F1E000
stack
page read and write
E9C000
stack
page read and write
286B000
trusted library allocation
page read and write
2886000
trusted library allocation
page read and write
3E09000
direct allocation
page read and write
2872000
trusted library allocation
page read and write
B00000
heap
page read and write
607E000
stack
page read and write
3E0D000
direct allocation
page read and write
61CD000
stack
page read and write
195E000
stack
page read and write
3E09000
direct allocation
page read and write
2A11000
trusted library allocation
page read and write
37F0000
heap
page read and write
2840000
trusted library allocation
page read and write
130E000
heap
page read and write
There are 324 hidden memdumps, click here to show them.