IOC Report
Factura adjunta.exe

loading gif

Files

File Path
Type
Category
Malicious
Factura adjunta.exe
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\Halitherses
data
dropped
C:\Users\user\AppData\Local\Temp\Lymnaeidae
ASCII text, with very long lines (28756), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\aut663B.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut6699.tmp
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Factura adjunta.exe
"C:\Users\user\Desktop\Factura adjunta.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\Factura adjunta.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.12.205
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://mail.floormelody.com.sg
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
ip-api.com
208.95.112.1
 malicious
mail.floormelody.com.sg
101.100.211.111
 malicious
api.ipify.org
104.26.12.205

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
malicious
101.100.211.111
mail.floormelody.com.sg
Singapore
malicious
104.26.12.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2ADF000
heap
page read and write
 malicious
2F81000
trusted library allocation
page read and write
 malicious
3EF1000
trusted library allocation
page read and write
 malicious
2F89000
trusted library allocation
page read and write
 malicious
2F57000
trusted library allocation
page read and write
 malicious
5270000
trusted library section
page read and write
 malicious
2E70000
trusted library section
page read and write
 malicious
6890000
trusted library allocation
page read and write
F46000
trusted library allocation
page execute and read and write
542C000
heap
page read and write
EBC000
heap
page read and write
F20000
trusted library allocation
page read and write
F52000
trusted library allocation
page read and write
D4E000
stack
page read and write
29C0000
trusted library allocation
page read and write
3570000
direct allocation
page read and write
FE2000
heap
page read and write
6840000
trusted library allocation
page read and write
2EE0000
heap
page read and write
664F000
stack
page read and write
67CE000
stack
page read and write
F0B000
heap
page read and write
2F90000
trusted library allocation
page read and write
8D8000
unkown
page write copy
ED0000
heap
page read and write
3699000
direct allocation
page read and write
5262000
trusted library allocation
page read and write
2D2C000
stack
page read and write
F88000
heap
page read and write
2920000
trusted library allocation
page execute and read and write
6810000
trusted library allocation
page read and write
102F000
heap
page read and write
ED0000
heap
page read and write
5310000
heap
page execute and read and write
F11000
heap
page read and write
33D0000
direct allocation
page read and write
36E9000
direct allocation
page read and write
D50000
heap
page read and write
4E0000
heap
page read and write
370E000
direct allocation
page read and write
375E000
direct allocation
page read and write
FF2000
heap
page read and write
9C8000
stack
page read and write
EFB000
heap
page read and write
F92000
heap
page read and write
36ED000
direct allocation
page read and write
34F3000
direct allocation
page read and write
EF0000
heap
page read and write
6BF5000
heap
page read and write
8D1000
unkown
page execute and read and write
64BF000
stack
page read and write
2F29000
trusted library allocation
page read and write
881000
unkown
page execute and write copy
C30000
heap
page read and write
FC0000
heap
page read and write
F10000
trusted library allocation
page read and write
EF0000
heap
page read and write
5256000
trusted library allocation
page read and write
2ED0000
trusted library allocation
page read and write
F23000
trusted library allocation
page execute and read and write
5A0000
heap
page read and write
29A0000
trusted library allocation
page read and write
F2D000
trusted library allocation
page execute and read and write
D85000
heap
page read and write
3420000
direct allocation
page read and write
375E000
direct allocation
page read and write
FB2000
heap
page read and write
6814000
trusted library allocation
page read and write
369D000
direct allocation
page read and write
3FF4000
trusted library allocation
page read and write
CA000
stack
page read and write
760000
direct allocation
page execute and read and write
375E000
direct allocation
page read and write
F92000
heap
page read and write
2F7F000
trusted library allocation
page read and write
5520000
heap
page read and write
668E000
stack
page read and write
FB2000
heap
page read and write
5483000
heap
page read and write
F11000
heap
page read and write
ED0000
heap
page read and write
5420000
heap
page read and write
2EF1000
trusted library allocation
page read and write
65BE000
stack
page read and write
34F3000
direct allocation
page read and write
6940000
heap
page read and write
445000
system
page execute and read and write
87E000
unkown
page execute and read and write
35C0000
direct allocation
page read and write
3543000
direct allocation
page read and write
CFF000
stack
page read and write
FC2000
heap
page read and write
8CA000
stack
page read and write
F30000
trusted library allocation
page read and write
D0B000
stack
page read and write
36ED000
direct allocation
page read and write
6BD0000
heap
page read and write
29D0000
heap
page read and write
523E000
trusted library allocation
page read and write
2CBF000
stack
page read and write
1A7E000
stack
page read and write
3699000
direct allocation
page read and write
F11000
heap
page read and write
F11000
heap
page read and write
369D000
direct allocation
page read and write
ECE000
stack
page read and write
6910000
trusted library allocation
page read and write
1BE000
stack
page read and write
F82000
heap
page read and write
6900000
trusted library allocation
page read and write
EE0000
heap
page read and write
2F7D000
trusted library allocation
page read and write
F5B000
trusted library allocation
page execute and read and write
F33000
trusted library allocation
page read and write
33D0000
direct allocation
page read and write
5230000
trusted library allocation
page read and write
F93000
heap
page read and write
F24000
trusted library allocation
page read and write
6970000
trusted library allocation
page execute and read and write
F11000
heap
page read and write
3420000
direct allocation
page read and write
F11000
heap
page read and write
7F490000
trusted library allocation
page execute and read and write
3699000
direct allocation
page read and write
525D000
trusted library allocation
page read and write
36ED000
direct allocation
page read and write
FE6000
heap
page read and write
5300000
heap
page read and write
571C000
stack
page read and write
400000
system
page execute and read and write
7B0000
unkown
page readonly
EFB000
heap
page read and write
2EDD000
trusted library allocation
page read and write
5AAE000
stack
page read and write
1C0000
heap
page read and write
2AA0000
trusted library allocation
page read and write
3543000
direct allocation
page read and write
2930000
trusted library allocation
page read and write
2E6E000
stack
page read and write
2950000
heap
page execute and read and write
660E000
stack
page read and write
CEF000
stack
page read and write
426000
system
page execute and read and write
FCA000
heap
page read and write
370E000
direct allocation
page read and write
54B6000
heap
page read and write
541F000
stack
page read and write
EC0000
heap
page read and write
590000
heap
page read and write
5251000
trusted library allocation
page read and write
3543000
direct allocation
page read and write
3420000
direct allocation
page read and write
2F95000
trusted library allocation
page read and write
68F0000
trusted library allocation
page execute and read and write
F83000
heap
page read and write
7050000
heap
page read and write
EC0000
heap
page read and write
370E000
direct allocation
page read and write
2F44000
trusted library allocation
page read and write
36E9000
direct allocation
page read and write
D80000
heap
page read and write
E80000
heap
page read and write
6897000
trusted library allocation
page read and write
29D6000
heap
page read and write
F11000
heap
page read and write
2AB0000
heap
page read and write
FB0000
heap
page read and write
6820000
trusted library allocation
page execute and read and write
680F000
stack
page read and write
2F9D000
trusted library allocation
page read and write
35C0000
direct allocation
page read and write
EFC000
heap
page read and write
F83000
heap
page read and write
F3D000
trusted library allocation
page execute and read and write
2F40000
trusted library allocation
page read and write
F70000
trusted library allocation
page read and write
6830000
trusted library allocation
page read and write
688E000
stack
page read and write
D70000
trusted library section
page read and write
E8E000
stack
page read and write
D2D000
stack
page read and write
3FB5000
trusted library allocation
page read and write
5422000
heap
page read and write
2E2E000
stack
page read and write
FBA000
heap
page read and write
17E000
stack
page read and write
86F000
unkown
page execute and read and write
6B2E000
stack
page read and write
34F3000
direct allocation
page read and write
2F9F000
trusted library allocation
page read and write
6849000
trusted library allocation
page read and write
29B0000
trusted library allocation
page read and write
F12000
heap
page read and write
8D8000
unkown
page read and write
35C0000
direct allocation
page read and write
EBB000
heap
page read and write
F11000
heap
page read and write
F40000
trusted library allocation
page read and write
5440000
heap
page read and write
52FC000
stack
page read and write
3570000
direct allocation
page read and write
5242000
trusted library allocation
page read and write
E20000
direct allocation
page read and write
5428000
heap
page read and write
F57000
trusted library allocation
page execute and read and write
F11000
heap
page read and write
ED0000
heap
page read and write
523B000
trusted library allocation
page read and write
167D000
stack
page read and write
FBD000
heap
page read and write
2AB4000
heap
page read and write
524E000
trusted library allocation
page read and write
7B1000
unkown
page execute and read and write
36E9000
direct allocation
page read and write
3570000
direct allocation
page read and write
EFB000
heap
page read and write
137E000
stack
page read and write
E88000
heap
page read and write
EB4000
heap
page read and write
2F33000
trusted library allocation
page read and write
299E000
stack
page read and write
5A6D000
stack
page read and write
4E4000
heap
page read and write
FC2000
heap
page read and write
865000
unkown
page execute and read and write
7B0000
unkown
page readonly
750000
heap
page read and write
5452000
heap
page read and write
2F9A000
trusted library allocation
page read and write
F80000
heap
page read and write
F11000
heap
page read and write
5A20000
trusted library allocation
page execute and read and write
ECF000
heap
page read and write
369D000
direct allocation
page read and write
130000
heap
page read and write
EB2000
heap
page read and write
F08000
heap
page read and write
F55000
trusted library allocation
page execute and read and write
2CE0000
heap
page read and write
ECF000
heap
page read and write
F11000
heap
page read and write
33D0000
direct allocation
page read and write
8D7000
unkown
page execute and write copy
F42000
trusted library allocation
page read and write
ED1000
heap
page read and write
ED0000
trusted library section
page read and write
29E8000
trusted library allocation
page read and write
678D000
stack
page read and write
F4A000
trusted library allocation
page execute and read and write
There are 239 hidden memdumps, click here to show them.