IOC Report
Ship Docs_CI PL HBL COO_.exe

loading gif

Files

File Path
Type
Category
Malicious
Ship Docs_CI PL HBL COO_.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\Graff
data
dropped
C:\Users\user\AppData\Local\Temp\aut5F9C.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut5FCC.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\vehiculation
ASCII text, with very long lines (28756), with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe
"C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\Ship Docs_CI PL HBL COO_.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.12.205
https://api.ipify.org
unknown
http://r10.o.lencr.org0#
unknown
https://account.dyn.com/
unknown
http://mail.suplementvases.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://r10.i.lencr.org/0
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1

Domains

Name
IP
Malicious
ip-api.com
208.95.112.1
 malicious
mail.suplementvases.com
131.226.2.151
 malicious
api.ipify.org
104.26.12.205

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
malicious
131.226.2.151
mail.suplementvases.com
United States
malicious
104.26.12.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
334C000
trusted library allocation
page read and write
 malicious
402000
system
page execute and read and write
 malicious
3010000
direct allocation
page read and write
 malicious
E3000
unkown
page write copy
3710000
direct allocation
page read and write
6E70000
heap
page read and write
19D0000
direct allocation
page execute and read and write
3520000
direct allocation
page read and write
FA9000
stack
page read and write
AF000
unkown
page readonly
661B000
heap
page read and write
3710000
direct allocation
page read and write
327B000
trusted library allocation
page read and write
A437000
heap
page read and write
C64000
heap
page read and write
D76000
heap
page read and write
32C0000
trusted library allocation
page read and write
141E000
stack
page read and write
3693000
direct allocation
page read and write
6D0D000
trusted library allocation
page read and write
33F7000
trusted library allocation
page read and write
5D60000
heap
page read and write
70C0000
trusted library allocation
page execute and read and write
A4B3000
heap
page read and write
6626000
heap
page read and write
17D0000
trusted library allocation
page read and write
4358000
trusted library allocation
page read and write
172E000
stack
page read and write
6603000
heap
page read and write
332E000
trusted library allocation
page read and write
65BB000
heap
page read and write
17ED000
trusted library allocation
page execute and read and write
3321000
trusted library allocation
page read and write
C56000
heap
page read and write
3332000
trusted library allocation
page read and write
366D000
trusted library allocation
page read and write
65E1000
heap
page read and write
3693000
direct allocation
page read and write
59DC000
stack
page read and write
C90000
heap
page read and write
3671000
trusted library allocation
page read and write
17F0000
trusted library allocation
page read and write
36C0000
direct allocation
page read and write
C86000
heap
page read and write
1320000
heap
page read and write
36C0000
direct allocation
page read and write
385E000
direct allocation
page read and write
4379000
trusted library allocation
page read and write
65B6000
heap
page read and write
21000
unkown
page execute read
8AFC000
stack
page read and write
32E0000
heap
page execute and read and write
A47F000
heap
page read and write
6C3E000
stack
page read and write
1815000
trusted library allocation
page execute and read and write
6636000
heap
page read and write
3839000
direct allocation
page read and write
3551000
trusted library allocation
page read and write
367A000
trusted library allocation
page read and write
A47B000
heap
page read and write
697E000
stack
page read and write
653D000
stack
page read and write
3839000
direct allocation
page read and write
701F000
stack
page read and write
663D000
heap
page read and write
322C000
stack
page read and write
6D60000
trusted library allocation
page read and write
1397000
heap
page read and write
6ABE000
stack
page read and write
3824000
trusted library allocation
page read and write
CA2000
heap
page read and write
3140000
heap
page read and write
CA2000
heap
page read and write
D45000
heap
page read and write
140B000
heap
page read and write
3628000
trusted library allocation
page read and write
38AE000
direct allocation
page read and write
37ED000
direct allocation
page read and write
9BF000
stack
page read and write
BCE000
stack
page read and write
654C000
heap
page read and write
1370000
heap
page read and write
BC3B000
stack
page read and write
6E40000
trusted library allocation
page read and write
6B3E000
stack
page read and write
3130000
trusted library allocation
page execute and read and write
13FE000
heap
page read and write
3401000
trusted library allocation
page read and write
3445000
trusted library allocation
page read and write
32D0000
trusted library allocation
page read and write
1802000
trusted library allocation
page read and write
74F0000
heap
page read and write
180A000
trusted library allocation
page execute and read and write
37ED000
direct allocation
page read and write
14B6000
heap
page read and write
3570000
direct allocation
page read and write
53ED000
stack
page read and write
A404000
heap
page read and write
A400000
heap
page read and write
D45000
heap
page read and write
32B0000
heap
page read and write
7500000
trusted library allocation
page read and write
19B0000
heap
page read and write
660A000
heap
page read and write
65F5000
heap
page read and write
328E000
trusted library allocation
page read and write
13E0000
heap
page read and write
CA5000
heap
page read and write
C5E000
heap
page read and write
16AC000
stack
page read and write
6DF0000
trusted library allocation
page read and write
38AE000
direct allocation
page read and write
7110000
trusted library allocation
page read and write
6548000
heap
page read and write
C73000
heap
page read and write
3240000
heap
page read and write
33BC000
trusted library allocation
page read and write
AF000
unkown
page readonly
181B000
trusted library allocation
page execute and read and write
CA2000
heap
page read and write
32B3000
heap
page read and write
3158000
trusted library allocation
page read and write
385E000
direct allocation
page read and write
69BE000
stack
page read and write
5D5E000
stack
page read and write
CA2000
heap
page read and write
3570000
direct allocation
page read and write
9DB000
stack
page read and write
1806000
trusted library allocation
page execute and read and write
3296000
trusted library allocation
page read and write
637E000
stack
page read and write
577C000
stack
page read and write
A485000
heap
page read and write
6AFE000
stack
page read and write
42F1000
trusted library allocation
page read and write
6540000
heap
page read and write
A4BA000
heap
page read and write
4399000
trusted library allocation
page read and write
D5000
unkown
page readonly
57D0000
heap
page execute and read and write
3336000
trusted library allocation
page read and write
38AE000
direct allocation
page read and write
3276000
trusted library allocation
page read and write
C85000
heap
page read and write
74AC000
stack
page read and write
5CDB000
stack
page read and write
736B000
stack
page read and write
33FD000
trusted library allocation
page read and write
1812000
trusted library allocation
page read and write
3282000
trusted library allocation
page read and write
36A5000
trusted library allocation
page read and write
16EE000
stack
page read and write
3570000
direct allocation
page read and write
6D00000
trusted library allocation
page read and write
65EF000
heap
page read and write
D47000
heap
page read and write
6D70000
trusted library allocation
page execute and read and write
C5E000
heap
page read and write
3655000
trusted library allocation
page read and write
57E0000
heap
page read and write
C64000
heap
page read and write
37ED000
direct allocation
page read and write
21000
unkown
page execute read
C73000
heap
page read and write
1817000
trusted library allocation
page execute and read and write
6D80000
trusted library allocation
page execute and read and write
37E9000
direct allocation
page read and write
1418000
heap
page read and write
181F000
stack
page read and write
13DE000
stack
page read and write
5A1E000
stack
page read and write
6D17000
trusted library allocation
page read and write
17E0000
trusted library allocation
page read and write
DF000
unkown
page read and write
6633000
heap
page read and write
A8E000
stack
page read and write
E8000
unkown
page readonly
3610000
trusted library allocation
page read and write
34AA000
trusted library allocation
page read and write
BB3C000
stack
page read and write
3260000
trusted library allocation
page read and write
385E000
direct allocation
page read and write
FE0000
heap
page read and write
57F0000
heap
page read and write
332A000
trusted library allocation
page read and write
136C000
stack
page read and write
17E4000
trusted library allocation
page read and write
5D80000
trusted library allocation
page read and write
3D9000
stack
page read and write
13E8000
heap
page read and write
6D10000
trusted library allocation
page read and write
7130000
heap
page read and write
687E000
stack
page read and write
400000
system
page execute and read and write
14B4000
heap
page read and write
746E000
stack
page read and write
3643000
direct allocation
page read and write
3643000
direct allocation
page read and write
37E9000
direct allocation
page read and write
35D9000
trusted library allocation
page read and write
5B1D000
stack
page read and write
17E3000
trusted library allocation
page execute and read and write
6DE0000
trusted library allocation
page read and write
5D1D000
stack
page read and write
6E30000
heap
page read and write
74FA000
heap
page read and write
21000
unkown
page execute read
1810000
trusted library allocation
page read and write
312F000
stack
page read and write
8400000
heap
page read and write
17FD000
trusted library allocation
page execute and read and write
1830000
trusted library allocation
page read and write
187E000
stack
page read and write
C28000
heap
page read and write
65B9000
heap
page read and write
3630000
trusted library allocation
page read and write
337B000
trusted library allocation
page read and write
A493000
heap
page read and write
CA4000
heap
page read and write
FE5000
heap
page read and write
37E9000
direct allocation
page read and write
AB0000
heap
page read and write
3230000
trusted library allocation
page read and write
4319000
trusted library allocation
page read and write
1800000
trusted library allocation
page read and write
3643000
direct allocation
page read and write
6DE6000
trusted library allocation
page read and write
1416000
heap
page read and write
C55000
heap
page read and write
3060000
heap
page read and write
3520000
direct allocation
page read and write
A41B000
heap
page read and write
E8000
unkown
page readonly
C74000
heap
page read and write
14AF000
heap
page read and write
3064000
heap
page read and write
333A000
trusted library allocation
page read and write
D76000
heap
page read and write
329D000
trusted library allocation
page read and write
DF000
unkown
page write copy
1390000
heap
page read and write
A40000
heap
page read and write
5B20000
heap
page read and write
20000
unkown
page readonly
D45000
heap
page read and write
65DA000
heap
page read and write
D65000
heap
page read and write
3553000
trusted library allocation
page read and write
383D000
direct allocation
page read and write
3598000
trusted library allocation
page read and write
7F290000
trusted library allocation
page execute and read and write
33B8000
trusted library allocation
page read and write
3447000
trusted library allocation
page read and write
36C0000
direct allocation
page read and write
D66000
heap
page read and write
662A000
heap
page read and write
6E00000
trusted library allocation
page read and write
327E000
trusted library allocation
page read and write
1479000
heap
page read and write
9FD000
stack
page read and write
D5000
unkown
page readonly
383D000
direct allocation
page read and write
3693000
direct allocation
page read and write
C20000
heap
page read and write
1458000
heap
page read and write
65FD000
heap
page read and write
9CF000
stack
page read and write
3291000
trusted library allocation
page read and write
D66000
heap
page read and write
655D000
heap
page read and write
20000
unkown
page readonly
D85000
heap
page read and write
3520000
direct allocation
page read and write
8410000
heap
page read and write
1880000
heap
page read and write
3710000
direct allocation
page read and write
32A2000
trusted library allocation
page read and write
32F1000
trusted library allocation
page read and write
5D88000
trusted library allocation
page read and write
1886000
heap
page read and write
C73000
heap
page read and write
D47000
heap
page read and write
662E000
heap
page read and write
3270000
trusted library allocation
page read and write
12F8000
stack
page read and write
3839000
direct allocation
page read and write
19F0000
heap
page read and write
383D000
direct allocation
page read and write
328A000
trusted library allocation
page read and write
A90000
heap
page read and write
CA2000
heap
page read and write
There are 281 hidden memdumps, click here to show them.