IOC Report
tgBNtoWqIp.exe

loading gif

Files

File Path
Type
Category
Malicious
tgBNtoWqIp.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\aut8E4A.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut8E7A.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\hepatoduodenostomy
ASCII text, with very long lines (28756), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\totten
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\tgBNtoWqIp.exe
"C:\Users\user\Desktop\tgBNtoWqIp.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\tgBNtoWqIp.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.13.205
http://r3.i.lencr.org/01
unknown
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://divanrestoran.com
unknown
http://ip-api.com
unknown
http://r3.o.lencr.org0
unknown
http://mail.divanrestoran.com
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
There are 3 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
divanrestoran.com
185.149.100.122
 malicious
ip-api.com
208.95.112.1
 malicious
mail.divanrestoran.com
unknown
 malicious
api.ipify.org
104.26.13.205

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
malicious
185.149.100.122
divanrestoran.com
Turkey
malicious
104.26.13.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2BB9000
trusted library allocation
page read and write
 malicious
2BC4000
trusted library allocation
page read and write
 malicious
2BB1000
trusted library allocation
page read and write
 malicious
27D0000
heap
page read and write
 malicious
3B21000
trusted library allocation
page read and write
 malicious
5220000
trusted library section
page read and write
 malicious
5160000
trusted library section
page read and write
 malicious
2B88000
trusted library allocation
page read and write
 malicious
1D3D000
heap
page read and write
1D75000
heap
page read and write
1B16000
heap
page read and write
51C0000
trusted library allocation
page read and write
2700000
trusted library allocation
page read and write
1AAD000
heap
page read and write
26EB000
trusted library allocation
page execute and read and write
111E000
stack
page read and write
1B06000
heap
page read and write
2B70000
trusted library allocation
page read and write
65DE000
stack
page read and write
6F30000
heap
page read and write
6860000
trusted library allocation
page read and write
448E000
direct allocation
page read and write
51CE000
trusted library allocation
page read and write
448E000
direct allocation
page read and write
17FC000
stack
page read and write
6764000
trusted library allocation
page read and write
6120000
trusted library allocation
page execute and read and write
F50000
heap
page read and write
1174000
heap
page read and write
26CD000
trusted library allocation
page execute and read and write
42A0000
direct allocation
page read and write
1028000
unkown
page readonly
53EC000
stack
page read and write
BF0000
trusted library section
page read and write
26A0000
trusted library allocation
page read and write
1CC8000
heap
page read and write
40B0000
direct allocation
page read and write
26B4000
trusted library allocation
page read and write
7C8000
stack
page read and write
3BEA000
trusted library allocation
page read and write
1170000
heap
page read and write
4419000
direct allocation
page read and write
443E000
direct allocation
page read and write
4419000
direct allocation
page read and write
4223000
direct allocation
page read and write
42A0000
direct allocation
page read and write
2A68000
trusted library allocation
page read and write
1B17000
heap
page read and write
67DE000
stack
page read and write
51DA000
trusted library allocation
page read and write
101F000
unkown
page write copy
62AD000
stack
page read and write
5210000
trusted library allocation
page read and write
43CD000
direct allocation
page read and write
1015000
unkown
page readonly
1B67000
heap
page read and write
2C89000
trusted library allocation
page read and write
3BD2000
trusted library allocation
page read and write
F60000
unkown
page readonly
C00000
heap
page read and write
1D47000
heap
page read and write
1A78000
heap
page read and write
6880000
trusted library allocation
page read and write
17CF000
stack
page read and write
28FC000
stack
page read and write
26D0000
trusted library allocation
page read and write
6799000
trusted library allocation
page read and write
1B48000
heap
page read and write
2B21000
trusted library allocation
page read and write
443E000
direct allocation
page read and write
43C9000
direct allocation
page read and write
26C3000
trusted library allocation
page read and write
2780000
heap
page execute and read and write
1B19000
heap
page read and write
27A0000
heap
page read and write
1B07000
heap
page read and write
1D99000
heap
page read and write
26B0000
trusted library allocation
page read and write
7F9A0000
trusted library allocation
page execute and read and write
63EE000
stack
page read and write
5486000
heap
page read and write
441D000
direct allocation
page read and write
1015000
unkown
page readonly
26E2000
trusted library allocation
page read and write
1AA7000
heap
page read and write
DFE000
stack
page read and write
42A0000
direct allocation
page read and write
2B74000
trusted library allocation
page read and write
43CD000
direct allocation
page read and write
4F60000
heap
page read and write
68C0000
trusted library allocation
page execute and read and write
51DE000
trusted library allocation
page read and write
A80000
heap
page read and write
E09000
stack
page read and write
6A8D000
heap
page read and write
2B61000
trusted library allocation
page read and write
2B6C000
trusted library allocation
page read and write
4273000
direct allocation
page read and write
277E000
stack
page read and write
1190000
heap
page read and write
269F000
stack
page read and write
2C98000
trusted library allocation
page read and write
28B7000
heap
page read and write
2BAD000
trusted library allocation
page read and write
4100000
direct allocation
page read and write
426000
system
page execute and read and write
6A80000
heap
page read and write
26DA000
trusted library allocation
page execute and read and write
42F0000
direct allocation
page read and write
C64000
heap
page read and write
2710000
heap
page read and write
2C77000
trusted library allocation
page read and write
2790000
trusted library allocation
page read and write
AD0000
heap
page read and write
E70000
heap
page read and write
26E0000
trusted library allocation
page read and write
4150000
direct allocation
page read and write
F60000
unkown
page readonly
68D0000
trusted library allocation
page read and write
2717000
heap
page read and write
54EE000
heap
page read and write
1B9C000
heap
page read and write
52EC000
stack
page read and write
26BD000
trusted library allocation
page execute and read and write
6850000
trusted library allocation
page execute and read and write
443E000
direct allocation
page read and write
1AFE000
heap
page read and write
CF5000
heap
page read and write
1AA4000
heap
page read and write
3C2E000
trusted library allocation
page read and write
FEF000
unkown
page readonly
6760000
trusted library allocation
page read and write
64ED000
stack
page read and write
4223000
direct allocation
page read and write
1023000
unkown
page write copy
226E000
stack
page read and write
446000
system
page execute and read and write
11D0000
heap
page read and write
1B28000
heap
page read and write
63AE000
stack
page read and write
4419000
direct allocation
page read and write
4273000
direct allocation
page read and write
2733000
heap
page read and write
4100000
direct allocation
page read and write
6790000
trusted library allocation
page read and write
A30000
heap
page read and write
17DB000
stack
page read and write
5200000
trusted library allocation
page read and write
6867000
trusted library allocation
page read and write
42F0000
direct allocation
page read and write
42F0000
direct allocation
page read and write
1AA2000
heap
page read and write
C08000
heap
page read and write
2C7C000
trusted library allocation
page read and write
2B10000
heap
page execute and read and write
17BF000
stack
page read and write
5760000
heap
page read and write
4223000
direct allocation
page read and write
6770000
trusted library allocation
page execute and read and write
C30000
heap
page read and write
26B3000
trusted library allocation
page execute and read and write
F61000
unkown
page execute read
1D1E000
heap
page read and write
5410000
heap
page read and write
43C9000
direct allocation
page read and write
4273000
direct allocation
page read and write
5750000
trusted library allocation
page read and write
1B16000
heap
page read and write
2B00000
trusted library allocation
page read and write
19D0000
heap
page read and write
51CB000
trusted library allocation
page read and write
2BAF000
trusted library allocation
page read and write
1D32000
heap
page read and write
26D6000
trusted library allocation
page execute and read and write
2A5F000
stack
page read and write
2C1C000
trusted library allocation
page read and write
2C65000
trusted library allocation
page read and write
51D2000
trusted library allocation
page read and write
CB0000
heap
page read and write
6780000
trusted library allocation
page read and write
4100000
direct allocation
page read and write
575D000
trusted library allocation
page read and write
2C67000
trusted library allocation
page read and write
26D2000
trusted library allocation
page read and write
4150000
direct allocation
page read and write
5414000
heap
page read and write
2950000
heap
page read and write
11B0000
direct allocation
page execute and read and write
448E000
direct allocation
page read and write
1ABC000
heap
page read and write
101F000
unkown
page read and write
1028000
unkown
page readonly
1B7D000
heap
page read and write
43CD000
direct allocation
page read and write
6CA000
stack
page read and write
1B67000
heap
page read and write
A7E000
stack
page read and write
51E6000
trusted library allocation
page read and write
F61000
unkown
page execute read
26C0000
trusted library allocation
page read and write
C69000
heap
page read and write
C3D000
heap
page read and write
BEE000
stack
page read and write
26E7000
trusted library allocation
page execute and read and write
441D000
direct allocation
page read and write
2B59000
trusted library allocation
page read and write
441D000
direct allocation
page read and write
1B38000
heap
page read and write
AC0000
trusted library section
page read and write
1A70000
heap
page read and write
2730000
heap
page read and write
43C9000
direct allocation
page read and write
68B0000
heap
page read and write
66DE000
stack
page read and write
1AAD000
heap
page read and write
6840000
trusted library allocation
page execute and read and write
1B19000
heap
page read and write
28B0000
heap
page read and write
AD5000
heap
page read and write
659E000
stack
page read and write
655D000
stack
page read and write
1B68000
heap
page read and write
AA0000
heap
page read and write
51C6000
trusted library allocation
page read and write
675F000
stack
page read and write
400000
system
page execute and read and write
5290000
trusted library allocation
page read and write
51E1000
trusted library allocation
page read and write
6870000
trusted library allocation
page read and write
671E000
stack
page read and write
67E0000
heap
page read and write
FEF000
unkown
page readonly
4C1E000
stack
page read and write
1CBE000
heap
page read and write
294E000
stack
page read and write
5452000
heap
page read and write
26E5000
trusted library allocation
page execute and read and write
10DD000
stack
page read and write
6A7E000
stack
page read and write
51ED000
trusted library allocation
page read and write
266F000
stack
page read and write
4150000
direct allocation
page read and write
2BCD000
trusted library allocation
page read and write
51F2000
trusted library allocation
page read and write
C3A000
heap
page read and write
515E000
stack
page read and write
2720000
trusted library allocation
page execute and read and write
There are 237 hidden memdumps, click here to show them.