Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Payment 23832 Proforma INV Bank Confirmation.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\aut2F74.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut2FF2.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\dews
|
ASCII text, with very long lines (28756), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\syphilous
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Payment 23832 Proforma INV Bank Confirmation.exe
|
"C:\Users\user\Desktop\Payment 23832 Proforma INV Bank Confirmation.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\Payment 23832 Proforma INV Bank Confirmation.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://r3.o.lencr.org0
|
unknown
|
||
|
http://kxnlaos.com
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
http://mail.kxnlaos.com
|
unknown
|
||
|
http://x1.c.lencr.org/0
|
unknown
|
||
|
http://x1.i.lencr.org/0
|
unknown
|
||
|
http://r3.i.lencr.org/0%
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
kxnlaos.com
|
192.185.113.233
|
|
|
|
mail.kxnlaos.com
|
unknown
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
192.185.113.233
|
kxnlaos.com
|
United States
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2AAE000
|
trusted library allocation
|
page read and write
|
|
|
|
2A61000
|
trusted library allocation
|
page read and write
|
|
|
|
14D0000
|
direct allocation
|
page read and write
|
|
|
|
402000
|
system
|
page execute and read and write
|
|
|
|
2AD9000
|
trusted library allocation
|
page read and write
|
|
|
|
3AB0000
|
direct allocation
|
page read and write
|
||
|
1561000
|
heap
|
page read and write
|
||
|
DF0000
|
unkown
|
page readonly
|
||
|
5100000
|
heap
|
page read and write
|
||
|
12EF000
|
stack
|
page read and write
|
||
|
C70000
|
heap
|
page read and write
|
||
|
1528000
|
heap
|
page read and write
|
||
|
DFC000
|
heap
|
page read and write
|
||
|
E0C000
|
heap
|
page read and write
|
||
|
504D000
|
trusted library allocation
|
page read and write
|
||
|
1593000
|
heap
|
page read and write
|
||
|
3ACA000
|
trusted library allocation
|
page read and write
|
||
|
5052000
|
trusted library allocation
|
page read and write
|
||
|
1570000
|
heap
|
page read and write
|
||
|
3DAE000
|
direct allocation
|
page read and write
|
||
|
1070000
|
trusted library allocation
|
page read and write
|
||
|
101B000
|
trusted library allocation
|
page execute and read and write
|
||
|
D1D000
|
trusted library allocation
|
page execute and read and write
|
||
|
D05000
|
heap
|
page read and write
|
||
|
5110000
|
heap
|
page read and write
|
||
|
1570000
|
heap
|
page read and write
|
||
|
D10000
|
trusted library allocation
|
page read and write
|
||
|
5666000
|
trusted library allocation
|
page read and write
|
||
|
1629000
|
heap
|
page read and write
|
||
|
1592000
|
heap
|
page read and write
|
||
|
6790000
|
trusted library allocation
|
page read and write
|
||
|
EBE000
|
unkown
|
page execute and read and write
|
||
|
564C000
|
trusted library allocation
|
page read and write
|
||
|
1629000
|
heap
|
page read and write
|
||
|
5060000
|
trusted library allocation
|
page read and write
|
||
|
3D79000
|
direct allocation
|
page read and write
|
||
|
D64000
|
heap
|
page read and write
|
||
|
AAE000
|
stack
|
page read and write
|
||
|
5041000
|
trusted library allocation
|
page read and write
|
||
|
D20000
|
trusted library allocation
|
page read and write
|
||
|
1629000
|
heap
|
page read and write
|
||
|
1012000
|
trusted library allocation
|
page read and write
|
||
|
1571000
|
heap
|
page read and write
|
||
|
5026000
|
trusted library allocation
|
page read and write
|
||
|
155B000
|
heap
|
page read and write
|
||
|
604D000
|
stack
|
page read and write
|
||
|
1572000
|
heap
|
page read and write
|
||
|
544E000
|
stack
|
page read and write
|
||
|
502E000
|
trusted library allocation
|
page read and write
|
||
|
1571000
|
heap
|
page read and write
|
||
|
5032000
|
trusted library allocation
|
page read and write
|
||
|
2AAC000
|
trusted library allocation
|
page read and write
|
||
|
3D39000
|
direct allocation
|
page read and write
|
||
|
6097000
|
trusted library allocation
|
page read and write
|
||
|
D13000
|
trusted library allocation
|
page execute and read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
1000000
|
trusted library allocation
|
page read and write
|
||
|
1570000
|
heap
|
page read and write
|
||
|
534E000
|
stack
|
page read and write
|
||
|
664E000
|
stack
|
page read and write
|
||
|
1592000
|
heap
|
page read and write
|
||
|
50DC000
|
stack
|
page read and write
|
||
|
AF0000
|
heap
|
page read and write
|
||
|
5024000
|
trusted library allocation
|
page read and write
|
||
|
211E000
|
stack
|
page read and write
|
||
|
D14000
|
trusted library allocation
|
page read and write
|
||
|
D38000
|
heap
|
page read and write
|
||
|
D00000
|
heap
|
page read and write
|
||
|
C60000
|
heap
|
page read and write
|
||
|
8FA000
|
stack
|
page read and write
|
||
|
100A000
|
trusted library allocation
|
page execute and read and write
|
||
|
3DAE000
|
direct allocation
|
page read and write
|
||
|
5E70000
|
heap
|
page read and write
|
||
|
2AD5000
|
trusted library allocation
|
page read and write
|
||
|
EA4000
|
unkown
|
page execute and write copy
|
||
|
CF0000
|
trusted library allocation
|
page read and write
|
||
|
3D3D000
|
direct allocation
|
page read and write
|
||
|
DF0000
|
unkown
|
page readonly
|
||
|
157E000
|
heap
|
page read and write
|
||
|
654E000
|
stack
|
page read and write
|
||
|
3AB0000
|
direct allocation
|
page read and write
|
||
|
1571000
|
heap
|
page read and write
|
||
|
9F9000
|
stack
|
page read and write
|
||
|
503A000
|
trusted library allocation
|
page read and write
|
||
|
D30000
|
heap
|
page read and write
|
||
|
2A5F000
|
stack
|
page read and write
|
||
|
10F8000
|
trusted library allocation
|
page read and write
|
||
|
15FE000
|
heap
|
page read and write
|
||
|
2AC7000
|
trusted library allocation
|
page read and write
|
||
|
C50000
|
heap
|
page read and write
|
||
|
5670000
|
trusted library allocation
|
page execute and read and write
|
||
|
530C000
|
stack
|
page read and write
|
||
|
C34000
|
heap
|
page read and write
|
||
|
1592000
|
heap
|
page read and write
|
||
|
5610000
|
trusted library allocation
|
page read and write
|
||
|
67D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
DCA000
|
heap
|
page read and write
|
||
|
1554000
|
heap
|
page read and write
|
||
|
1592000
|
heap
|
page read and write
|
||
|
55CD000
|
stack
|
page read and write
|
||
|
1520000
|
heap
|
page read and write
|
||
|
5ED3000
|
heap
|
page read and write
|
||
|
558F000
|
stack
|
page read and write
|
||
|
1592000
|
heap
|
page read and write
|
||
|
1030000
|
trusted library allocation
|
page read and write
|
||
|
503E000
|
trusted library allocation
|
page read and write
|
||
|
1190000
|
heap
|
page read and write
|
||
|
5FAF000
|
stack
|
page read and write
|
||
|
3D3D000
|
direct allocation
|
page read and write
|
||
|
1015000
|
trusted library allocation
|
page execute and read and write
|
||
|
2AE1000
|
trusted library allocation
|
page read and write
|
||
|
5090000
|
heap
|
page execute and read and write
|
||
|
1628000
|
heap
|
page read and write
|
||
|
3D3D000
|
direct allocation
|
page read and write
|
||
|
5618000
|
trusted library allocation
|
page read and write
|
||
|
3C50000
|
direct allocation
|
page read and write
|
||
|
3DEE000
|
direct allocation
|
page read and write
|
||
|
D2D000
|
trusted library allocation
|
page execute and read and write
|
||
|
DF1000
|
unkown
|
page execute and read and write
|
||
|
3D79000
|
direct allocation
|
page read and write
|
||
|
130B000
|
stack
|
page read and write
|
||
|
EA5000
|
unkown
|
page execute and read and write
|
||
|
157E000
|
heap
|
page read and write
|
||
|
5046000
|
trusted library allocation
|
page read and write
|
||
|
EFB000
|
unkown
|
page read and write
|
||
|
3B93000
|
direct allocation
|
page read and write
|
||
|
D5A000
|
heap
|
page read and write
|
||
|
3A70000
|
direct allocation
|
page read and write
|
||
|
EFA000
|
unkown
|
page execute and write copy
|
||
|
C30000
|
heap
|
page read and write
|
||
|
6090000
|
trusted library allocation
|
page read and write
|
||
|
1629000
|
heap
|
page read and write
|
||
|
1591000
|
heap
|
page read and write
|
||
|
EFB000
|
unkown
|
page write copy
|
||
|
7FA000
|
stack
|
page read and write
|
||
|
E03000
|
heap
|
page read and write
|
||
|
3A89000
|
trusted library allocation
|
page read and write
|
||
|
60A0000
|
trusted library allocation
|
page read and write
|
||
|
3D7D000
|
direct allocation
|
page read and write
|
||
|
1561000
|
heap
|
page read and write
|
||
|
D4E000
|
heap
|
page read and write
|
||
|
1592000
|
heap
|
page read and write
|
||
|
EAF000
|
unkown
|
page execute and read and write
|
||
|
3BD3000
|
direct allocation
|
page read and write
|
||
|
3D7D000
|
direct allocation
|
page read and write
|
||
|
3D39000
|
direct allocation
|
page read and write
|
||
|
502B000
|
trusted library allocation
|
page read and write
|
||
|
5650000
|
trusted library allocation
|
page read and write
|
||
|
3B93000
|
direct allocation
|
page read and write
|
||
|
1002000
|
trusted library allocation
|
page read and write
|
||
|
5020000
|
trusted library allocation
|
page read and write
|
||
|
1D1E000
|
stack
|
page read and write
|
||
|
CB0000
|
heap
|
page read and write
|
||
|
1571000
|
heap
|
page read and write
|
||
|
1628000
|
heap
|
page read and write
|
||
|
1050000
|
heap
|
page execute and read and write
|
||
|
14C0000
|
direct allocation
|
page execute and read and write
|
||
|
1080000
|
heap
|
page read and write
|
||
|
7F860000
|
trusted library allocation
|
page execute and read and write
|
||
|
69B0000
|
heap
|
page read and write
|
||
|
5D6E000
|
stack
|
page read and write
|
||
|
AEE000
|
stack
|
page read and write
|
||
|
5103000
|
heap
|
page read and write
|
||
|
3D79000
|
direct allocation
|
page read and write
|
||
|
10EE000
|
stack
|
page read and write
|
||
|
EF4000
|
unkown
|
page execute and read and write
|
||
|
12FF000
|
stack
|
page read and write
|
||
|
4B9D000
|
stack
|
page read and write
|
||
|
15FE000
|
heap
|
page read and write
|
||
|
A60000
|
heap
|
page read and write
|
||
|
3C10000
|
direct allocation
|
page read and write
|
||
|
1571000
|
heap
|
page read and write
|
||
|
67C0000
|
heap
|
page read and write
|
||
|
3D39000
|
direct allocation
|
page read and write
|
||
|
3A70000
|
direct allocation
|
page read and write
|
||
|
624D000
|
stack
|
page read and write
|
||
|
E22000
|
heap
|
page read and write
|
||
|
D66000
|
heap
|
page read and write
|
||
|
1060000
|
trusted library allocation
|
page read and write
|
||
|
3C10000
|
direct allocation
|
page read and write
|
||
|
11B0000
|
heap
|
page read and write
|
||
|
E2D000
|
heap
|
page read and write
|
||
|
1090000
|
trusted library allocation
|
page read and write
|
||
|
3D7D000
|
direct allocation
|
page read and write
|
||
|
10A0000
|
heap
|
page read and write
|
||
|
3AB0000
|
direct allocation
|
page read and write
|
||
|
3BD3000
|
direct allocation
|
page read and write
|
||
|
3C50000
|
direct allocation
|
page read and write
|
||
|
1552000
|
heap
|
page read and write
|
||
|
3DEE000
|
direct allocation
|
page read and write
|
||
|
1040000
|
trusted library allocation
|
page execute and read and write
|
||
|
3A61000
|
trusted library allocation
|
page read and write
|
||
|
3DAE000
|
direct allocation
|
page read and write
|
||
|
4A9C000
|
stack
|
page read and write
|
||
|
5FB0000
|
trusted library allocation
|
page execute and read and write
|
||
|
1006000
|
trusted library allocation
|
page execute and read and write
|
||
|
56BD000
|
stack
|
page read and write
|
||
|
1580000
|
heap
|
page read and write
|
||
|
B00000
|
heap
|
page read and write
|
||
|
548E000
|
stack
|
page read and write
|
||
|
3BD3000
|
direct allocation
|
page read and write
|
||
|
157E000
|
heap
|
page read and write
|
||
|
162A000
|
heap
|
page read and write
|
||
|
5640000
|
trusted library allocation
|
page read and write
|
||
|
5EB6000
|
heap
|
page read and write
|
||
|
155B000
|
heap
|
page read and write
|
||
|
3A70000
|
direct allocation
|
page read and write
|
||
|
1592000
|
heap
|
page read and write
|
||
|
3B93000
|
direct allocation
|
page read and write
|
||
|
3DEE000
|
direct allocation
|
page read and write
|
||
|
132D000
|
stack
|
page read and write
|
||
|
5660000
|
trusted library allocation
|
page read and write
|
||
|
3C50000
|
direct allocation
|
page read and write
|
||
|
3C10000
|
direct allocation
|
page read and write
|
||
|
1017000
|
trusted library allocation
|
page execute and read and write
|
There are 205 hidden memdumps, click here to show them.