Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
rnoahcrypter.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\aut21A8.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut2216.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\derogates
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nonplacental
|
ASCII text, with very long lines (28756), with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\rnoahcrypter.exe
|
"C:\Users\user\Desktop\rnoahcrypter.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\rnoahcrypter.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://api.ipify.org/
|
104.26.13.205
|
||
|
https://api.ipify.org
|
unknown
|
||
|
https://sectigo.com/CPS0
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
https://api.ipify.org/t
|
unknown
|
||
|
http://mail.magna.com.pk
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://ocsp.c)
|
unknown
|
||
|
http://crl.co
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
mail.magna.com.pk
|
164.68.127.9
|
|
|
|
api.ipify.org
|
104.26.13.205
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
164.68.127.9
|
mail.magna.com.pk
|
Germany
|
|
|
|
104.26.13.205
|
api.ipify.org
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2CB0000
|
trusted library section
|
page read and write
|
|
|
|
28DF000
|
heap
|
page read and write
|
|
|
|
3D61000
|
trusted library allocation
|
page read and write
|
|
|
|
2DDF000
|
trusted library allocation
|
page read and write
|
|
|
|
51A0000
|
trusted library section
|
page read and write
|
|
|
|
2DB4000
|
trusted library allocation
|
page read and write
|
|
|
|
2DE7000
|
trusted library allocation
|
page read and write
|
|
|
|
2DF2000
|
trusted library allocation
|
page read and write
|
|
|
|
4253000
|
direct allocation
|
page read and write
|
||
|
2765000
|
trusted library allocation
|
page execute and read and write
|
||
|
65D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
15DB000
|
stack
|
page read and write
|
||
|
43FD000
|
direct allocation
|
page read and write
|
||
|
E3F000
|
unkown
|
page write copy
|
||
|
19DB000
|
heap
|
page read and write
|
||
|
6A90000
|
trusted library allocation
|
page read and write
|
||
|
2D0B000
|
trusted library allocation
|
page read and write
|
||
|
2890000
|
trusted library allocation
|
page read and write
|
||
|
65B8000
|
trusted library allocation
|
page read and write
|
||
|
2D40000
|
trusted library allocation
|
page read and write
|
||
|
4253000
|
direct allocation
|
page read and write
|
||
|
662E000
|
stack
|
page read and write
|
||
|
2B60000
|
heap
|
page read and write
|
||
|
446E000
|
direct allocation
|
page read and write
|
||
|
5240000
|
heap
|
page read and write
|
||
|
43F9000
|
direct allocation
|
page read and write
|
||
|
D80000
|
unkown
|
page readonly
|
||
|
2D2D000
|
trusted library allocation
|
page read and write
|
||
|
2D0E000
|
trusted library allocation
|
page read and write
|
||
|
57A0000
|
trusted library allocation
|
page read and write
|
||
|
1A19000
|
heap
|
page read and write
|
||
|
CF1000
|
heap
|
page read and write
|
||
|
55DE000
|
stack
|
page read and write
|
||
|
51F0000
|
heap
|
page execute and read and write
|
||
|
1919000
|
heap
|
page read and write
|
||
|
547C000
|
stack
|
page read and write
|
||
|
4130000
|
direct allocation
|
page read and write
|
||
|
2D61000
|
trusted library allocation
|
page read and write
|
||
|
3D40000
|
direct allocation
|
page read and write
|
||
|
18F1000
|
heap
|
page read and write
|
||
|
28A0000
|
trusted library allocation
|
page read and write
|
||
|
2D12000
|
trusted library allocation
|
page read and write
|
||
|
42D0000
|
direct allocation
|
page read and write
|
||
|
3E23000
|
trusted library allocation
|
page read and write
|
||
|
445000
|
system
|
page execute and read and write
|
||
|
C70000
|
trusted library section
|
page read and write
|
||
|
1A2A000
|
heap
|
page read and write
|
||
|
43F9000
|
direct allocation
|
page read and write
|
||
|
2733000
|
trusted library allocation
|
page execute and read and write
|
||
|
3DE0000
|
heap
|
page read and write
|
||
|
2D26000
|
trusted library allocation
|
page read and write
|
||
|
190D000
|
heap
|
page read and write
|
||
|
19D1000
|
heap
|
page read and write
|
||
|
54A0000
|
heap
|
page read and write
|
||
|
56DE000
|
stack
|
page read and write
|
||
|
2D1A000
|
trusted library allocation
|
page read and write
|
||
|
4130000
|
direct allocation
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
2ABE000
|
stack
|
page read and write
|
||
|
1919000
|
heap
|
page read and write
|
||
|
43F9000
|
direct allocation
|
page read and write
|
||
|
61A0000
|
heap
|
page read and write
|
||
|
1870000
|
heap
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
19FA000
|
heap
|
page read and write
|
||
|
17B0000
|
heap
|
page read and write
|
||
|
170D000
|
stack
|
page read and write
|
||
|
1919000
|
heap
|
page read and write
|
||
|
E0F000
|
unkown
|
page readonly
|
||
|
2730000
|
trusted library allocation
|
page read and write
|
||
|
7F280000
|
trusted library allocation
|
page execute and read and write
|
||
|
2D00000
|
trusted library allocation
|
page read and write
|
||
|
647E000
|
stack
|
page read and write
|
||
|
1919000
|
heap
|
page read and write
|
||
|
2760000
|
trusted library allocation
|
page read and write
|
||
|
D81000
|
unkown
|
page execute read
|
||
|
7C0000
|
heap
|
page read and write
|
||
|
42D0000
|
direct allocation
|
page read and write
|
||
|
3E61000
|
trusted library allocation
|
page read and write
|
||
|
43F9000
|
direct allocation
|
page read and write
|
||
|
CCB000
|
heap
|
page read and write
|
||
|
1A19000
|
heap
|
page read and write
|
||
|
282C000
|
stack
|
page read and write
|
||
|
4130000
|
direct allocation
|
page read and write
|
||
|
643E000
|
stack
|
page read and write
|
||
|
27E3000
|
heap
|
page read and write
|
||
|
2D21000
|
trusted library allocation
|
page read and write
|
||
|
18B2000
|
heap
|
page read and write
|
||
|
D81000
|
unkown
|
page execute read
|
||
|
276B000
|
trusted library allocation
|
page execute and read and write
|
||
|
E48000
|
unkown
|
page readonly
|
||
|
4253000
|
direct allocation
|
page read and write
|
||
|
43FD000
|
direct allocation
|
page read and write
|
||
|
42D0000
|
direct allocation
|
page read and write
|
||
|
54E2000
|
heap
|
page read and write
|
||
|
275A000
|
trusted library allocation
|
page execute and read and write
|
||
|
1A1A000
|
heap
|
page read and write
|
||
|
42D0000
|
direct allocation
|
page read and write
|
||
|
F39000
|
stack
|
page read and write
|
||
|
446E000
|
direct allocation
|
page read and write
|
||
|
D03000
|
heap
|
page read and write
|
||
|
446E000
|
direct allocation
|
page read and write
|
||
|
246E000
|
stack
|
page read and write
|
||
|
65B0000
|
trusted library allocation
|
page read and write
|
||
|
2762000
|
trusted library allocation
|
page read and write
|
||
|
537C000
|
stack
|
page read and write
|
||
|
43FD000
|
direct allocation
|
page read and write
|
||
|
2C6E000
|
stack
|
page read and write
|
||
|
1A0A000
|
heap
|
page read and write
|
||
|
191A000
|
heap
|
page read and write
|
||
|
2840000
|
trusted library allocation
|
page read and write
|
||
|
1A1A000
|
heap
|
page read and write
|
||
|
1919000
|
heap
|
page read and write
|
||
|
AF8000
|
stack
|
page read and write
|
||
|
7F0000
|
heap
|
page read and write
|
||
|
1919000
|
heap
|
page read and write
|
||
|
54B8000
|
heap
|
page read and write
|
||
|
7E0000
|
heap
|
page read and write
|
||
|
446E000
|
direct allocation
|
page read and write
|
||
|
43F9000
|
direct allocation
|
page read and write
|
||
|
D3B000
|
heap
|
page read and write
|
||
|
1919000
|
heap
|
page read and write
|
||
|
4130000
|
direct allocation
|
page read and write
|
||
|
C80000
|
trusted library allocation
|
page read and write
|
||
|
CCD000
|
heap
|
page read and write
|
||
|
426000
|
system
|
page execute and read and write
|
||
|
18A4000
|
heap
|
page read and write
|
||
|
273D000
|
trusted library allocation
|
page execute and read and write
|
||
|
657E000
|
stack
|
page read and write
|
||
|
2830000
|
trusted library allocation
|
page execute and read and write
|
||
|
E3F000
|
unkown
|
page read and write
|
||
|
18A6000
|
heap
|
page read and write
|
||
|
190C000
|
heap
|
page read and write
|
||
|
2750000
|
trusted library allocation
|
page read and write
|
||
|
2767000
|
trusted library allocation
|
page execute and read and write
|
||
|
1939000
|
heap
|
page read and write
|
||
|
2DB0000
|
trusted library allocation
|
page read and write
|
||
|
4253000
|
direct allocation
|
page read and write
|
||
|
2850000
|
heap
|
page read and write
|
||
|
6700000
|
trusted library allocation
|
page read and write
|
||
|
61B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2D50000
|
heap
|
page read and write
|
||
|
D80000
|
unkown
|
page readonly
|
||
|
C90000
|
heap
|
page read and write
|
||
|
559C000
|
heap
|
page read and write
|
||
|
2CAE000
|
stack
|
page read and write
|
||
|
2D06000
|
trusted library allocation
|
page read and write
|
||
|
54ED000
|
heap
|
page read and write
|
||
|
E48000
|
unkown
|
page readonly
|
||
|
7C5000
|
heap
|
page read and write
|
||
|
28B7000
|
heap
|
page read and write
|
||
|
1A27000
|
heap
|
page read and write
|
||
|
2790000
|
trusted library allocation
|
page read and write
|
||
|
4130000
|
direct allocation
|
page read and write
|
||
|
1A0B000
|
heap
|
page read and write
|
||
|
27E0000
|
heap
|
page read and write
|
||
|
E35000
|
unkown
|
page readonly
|
||
|
5F5E000
|
stack
|
page read and write
|
||
|
519F000
|
stack
|
page read and write
|
||
|
18B2000
|
heap
|
page read and write
|
||
|
57AD000
|
trusted library allocation
|
page read and write
|
||
|
6D00000
|
heap
|
page read and write
|
||
|
1919000
|
heap
|
page read and write
|
||
|
4253000
|
direct allocation
|
page read and write
|
||
|
FA0000
|
heap
|
page read and write
|
||
|
2AC8000
|
trusted library allocation
|
page read and write
|
||
|
2DA3000
|
trusted library allocation
|
page read and write
|
||
|
18FC000
|
heap
|
page read and write
|
||
|
43FD000
|
direct allocation
|
page read and write
|
||
|
4253000
|
direct allocation
|
page read and write
|
||
|
2756000
|
trusted library allocation
|
page execute and read and write
|
||
|
27DE000
|
stack
|
page read and write
|
||
|
2D1E000
|
trusted library allocation
|
page read and write
|
||
|
2780000
|
heap
|
page read and write
|
||
|
446E000
|
direct allocation
|
page read and write
|
||
|
19FB000
|
heap
|
page read and write
|
||
|
1A2A000
|
heap
|
page read and write
|
||
|
E35000
|
unkown
|
page readonly
|
||
|
42D0000
|
direct allocation
|
page read and write
|
||
|
2D9A000
|
trusted library allocation
|
page read and write
|
||
|
2740000
|
trusted library allocation
|
page read and write
|
||
|
571E000
|
stack
|
page read and write
|
||
|
C60000
|
trusted library section
|
page read and write
|
||
|
65E0000
|
trusted library allocation
|
page read and write
|
||
|
15BE000
|
stack
|
page read and write
|
||
|
CC0000
|
heap
|
page read and write
|
||
|
43FD000
|
direct allocation
|
page read and write
|
||
|
2630000
|
heap
|
page read and write
|
||
|
18B2000
|
heap
|
page read and write
|
||
|
65C4000
|
trusted library allocation
|
page read and write
|
||
|
575E000
|
stack
|
page read and write
|
||
|
43FD000
|
direct allocation
|
page read and write
|
||
|
E0F000
|
unkown
|
page readonly
|
||
|
6AC0000
|
heap
|
page read and write
|
||
|
446E000
|
direct allocation
|
page read and write
|
||
|
2752000
|
trusted library allocation
|
page read and write
|
||
|
42D0000
|
direct allocation
|
page read and write
|
||
|
5518000
|
heap
|
page read and write
|
||
|
65C0000
|
trusted library allocation
|
page read and write
|
||
|
76A000
|
stack
|
page read and write
|
||
|
1878000
|
heap
|
page read and write
|
||
|
C98000
|
heap
|
page read and write
|
||
|
557C000
|
heap
|
page read and write
|
||
|
15FC000
|
stack
|
page read and write
|
||
|
4130000
|
direct allocation
|
page read and write
|
||
|
1790000
|
direct allocation
|
page execute and read and write
|
||
|
5E5F000
|
stack
|
page read and write
|
||
|
2DDB000
|
trusted library allocation
|
page read and write
|
||
|
274D000
|
trusted library allocation
|
page execute and read and write
|
||
|
66BE000
|
stack
|
page read and write
|
||
|
15CE000
|
stack
|
page read and write
|
||
|
6A80000
|
trusted library allocation
|
page execute and read and write
|
||
|
6710000
|
trusted library allocation
|
page read and write
|
||
|
FEE000
|
stack
|
page read and write
|
||
|
2743000
|
trusted library allocation
|
page read and write
|
||
|
1919000
|
heap
|
page read and write
|
||
|
28B0000
|
heap
|
page read and write
|
||
|
2DDD000
|
trusted library allocation
|
page read and write
|
||
|
3DE4000
|
heap
|
page read and write
|
||
|
2734000
|
trusted library allocation
|
page read and write
|
||
|
CEE000
|
heap
|
page read and write
|
||
|
18FD000
|
heap
|
page read and write
|
||
|
E43000
|
unkown
|
page write copy
|
||
|
633D000
|
stack
|
page read and write
|
||
|
1A39000
|
heap
|
page read and write
|
||
|
190C000
|
heap
|
page read and write
|
||
|
2870000
|
heap
|
page execute and read and write
|
||
|
6707000
|
trusted library allocation
|
page read and write
|
||
|
18AD000
|
heap
|
page read and write
|
||
|
D82000
|
heap
|
page read and write
|
||
|
206E000
|
stack
|
page read and write
|
||
|
18AD000
|
heap
|
page read and write
|
||
|
5220000
|
trusted library allocation
|
page read and write
|
||
|
1770000
|
heap
|
page read and write
|
||
|
19BC000
|
heap
|
page read and write
|
||
|
1919000
|
heap
|
page read and write
|
||
|
43F9000
|
direct allocation
|
page read and write
|
There are 227 hidden memdumps, click here to show them.