Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
XX(1).exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\Ramada
|
ASCII text, with very long lines (29780), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\autA32.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\autA71.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\polygamodioecious
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\XX(1).exe
|
"C:\Users\user\Desktop\XX(1).exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\XX(1).exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://api.ipify.org/
|
172.67.74.152
|
||
|
https://api.ipify.org
|
unknown
|
||
|
https://sectigo.com/CPS0
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
https://api.ipify.org/t
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://magnatextile.com
|
unknown
|
||
|
http://mail.magnatextile.com
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
magnatextile.com
|
164.68.127.9
|
|
|
|
mail.magnatextile.com
|
unknown
|
|
|
|
api.ipify.org
|
172.67.74.152
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
164.68.127.9
|
magnatextile.com
|
Germany
|
|
|
|
172.67.74.152
|
api.ipify.org
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
4411000
|
trusted library allocation
|
page read and write
|
|
|
|
5A90000
|
trusted library section
|
page read and write
|
|
|
|
59D0000
|
trusted library section
|
page read and write
|
|
|
|
3464000
|
trusted library allocation
|
page read and write
|
|
|
|
312F000
|
heap
|
page read and write
|
|
|
|
348F000
|
trusted library allocation
|
page read and write
|
|
|
|
34A3000
|
trusted library allocation
|
page read and write
|
|
|
|
3497000
|
trusted library allocation
|
page read and write
|
|
|
|
5FC0000
|
trusted library allocation
|
page read and write
|
||
|
5A52000
|
trusted library allocation
|
page read and write
|
||
|
14E6000
|
heap
|
page read and write
|
||
|
3B60000
|
direct allocation
|
page read and write
|
||
|
5FD0000
|
heap
|
page read and write
|
||
|
7F070000
|
trusted library allocation
|
page execute and read and write
|
||
|
3070000
|
trusted library allocation
|
page read and write
|
||
|
671E000
|
stack
|
page read and write
|
||
|
3030000
|
trusted library allocation
|
page read and write
|
||
|
5A40000
|
trusted library allocation
|
page read and write
|
||
|
5A61000
|
trusted library allocation
|
page read and write
|
||
|
13A4000
|
heap
|
page read and write
|
||
|
1375000
|
heap
|
page read and write
|
||
|
9F0000
|
unkown
|
page readonly
|
||
|
1384000
|
heap
|
page read and write
|
||
|
3DD9000
|
direct allocation
|
page read and write
|
||
|
6C1D000
|
stack
|
page read and write
|
||
|
3218000
|
trusted library allocation
|
page read and write
|
||
|
348B000
|
trusted library allocation
|
page read and write
|
||
|
3E4E000
|
direct allocation
|
page read and write
|
||
|
9F1000
|
unkown
|
page execute read
|
||
|
5FCD000
|
trusted library allocation
|
page read and write
|
||
|
5D94000
|
heap
|
page read and write
|
||
|
3E2D000
|
direct allocation
|
page read and write
|
||
|
3DD9000
|
direct allocation
|
page read and write
|
||
|
12CB000
|
heap
|
page read and write
|
||
|
1322000
|
heap
|
page read and write
|
||
|
11FD000
|
stack
|
page read and write
|
||
|
3B10000
|
direct allocation
|
page read and write
|
||
|
3D00000
|
direct allocation
|
page read and write
|
||
|
5A4B000
|
trusted library allocation
|
page read and write
|
||
|
5A80000
|
trusted library allocation
|
page read and write
|
||
|
4516000
|
trusted library allocation
|
page read and write
|
||
|
1270000
|
heap
|
page read and write
|
||
|
1365000
|
heap
|
page read and write
|
||
|
1263000
|
heap
|
page read and write
|
||
|
3E29000
|
direct allocation
|
page read and write
|
||
|
3460000
|
trusted library allocation
|
page read and write
|
||
|
6EB0000
|
trusted library allocation
|
page execute and read and write
|
||
|
3E29000
|
direct allocation
|
page read and write
|
||
|
3750000
|
direct allocation
|
page execute and read and write
|
||
|
125A000
|
stack
|
page read and write
|
||
|
13C0000
|
heap
|
page read and write
|
||
|
6E90000
|
trusted library allocation
|
page read and write
|
||
|
6F0D000
|
stack
|
page read and write
|
||
|
44D3000
|
trusted library allocation
|
page read and write
|
||
|
3090000
|
trusted library allocation
|
page read and write
|
||
|
5B00000
|
trusted library allocation
|
page read and write
|
||
|
1521000
|
heap
|
page read and write
|
||
|
3075000
|
trusted library allocation
|
page execute and read and write
|
||
|
14B2000
|
heap
|
page read and write
|
||
|
3B60000
|
direct allocation
|
page read and write
|
||
|
6F9E000
|
stack
|
page read and write
|
||
|
7370000
|
trusted library allocation
|
page read and write
|
||
|
3E2D000
|
direct allocation
|
page read and write
|
||
|
65DD000
|
stack
|
page read and write
|
||
|
11BF000
|
stack
|
page read and write
|
||
|
3DDD000
|
direct allocation
|
page read and write
|
||
|
3CB0000
|
direct allocation
|
page read and write
|
||
|
9F0000
|
unkown
|
page readonly
|
||
|
AAF000
|
unkown
|
page read and write
|
||
|
A7F000
|
unkown
|
page readonly
|
||
|
3C33000
|
direct allocation
|
page read and write
|
||
|
AA5000
|
unkown
|
page readonly
|
||
|
5A4E000
|
trusted library allocation
|
page read and write
|
||
|
5D80000
|
heap
|
page read and write
|
||
|
3B10000
|
direct allocation
|
page read and write
|
||
|
899000
|
stack
|
page read and write
|
||
|
73A0000
|
heap
|
page read and write
|
||
|
3CB0000
|
direct allocation
|
page read and write
|
||
|
32B0000
|
trusted library allocation
|
page read and write
|
||
|
30F7000
|
heap
|
page read and write
|
||
|
3034000
|
trusted library allocation
|
page read and write
|
||
|
37C4000
|
heap
|
page read and write
|
||
|
5C5C000
|
stack
|
page read and write
|
||
|
6D1F000
|
stack
|
page read and write
|
||
|
30E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
14D3000
|
heap
|
page read and write
|
||
|
6EA0000
|
trusted library allocation
|
page read and write
|
||
|
303D000
|
trusted library allocation
|
page execute and read and write
|
||
|
12CB000
|
heap
|
page read and write
|
||
|
13E5000
|
heap
|
page read and write
|
||
|
3E29000
|
direct allocation
|
page read and write
|
||
|
6E98000
|
trusted library allocation
|
page read and write
|
||
|
3066000
|
trusted library allocation
|
page execute and read and write
|
||
|
9D0000
|
heap
|
page read and write
|
||
|
3B10000
|
direct allocation
|
page read and write
|
||
|
1394000
|
heap
|
page read and write
|
||
|
348D000
|
trusted library allocation
|
page read and write
|
||
|
304D000
|
trusted library allocation
|
page execute and read and write
|
||
|
6E5D000
|
stack
|
page read and write
|
||
|
9A0000
|
heap
|
page read and write
|
||
|
2FE0000
|
heap
|
page read and write
|
||
|
11DB000
|
stack
|
page read and write
|
||
|
5FBE000
|
stack
|
page read and write
|
||
|
9F1000
|
unkown
|
page execute read
|
||
|
1375000
|
heap
|
page read and write
|
||
|
3060000
|
trusted library allocation
|
page read and write
|
||
|
307B000
|
trusted library allocation
|
page execute and read and write
|
||
|
990000
|
heap
|
page read and write
|
||
|
3072000
|
trusted library allocation
|
page read and write
|
||
|
6FE7000
|
trusted library allocation
|
page read and write
|
||
|
3DDD000
|
direct allocation
|
page read and write
|
||
|
3B60000
|
direct allocation
|
page read and write
|
||
|
3043000
|
trusted library allocation
|
page read and write
|
||
|
33FE000
|
stack
|
page read and write
|
||
|
3053000
|
heap
|
page read and write
|
||
|
3C83000
|
direct allocation
|
page read and write
|
||
|
3000000
|
trusted library section
|
page read and write
|
||
|
3E4E000
|
direct allocation
|
page read and write
|
||
|
12CB000
|
heap
|
page read and write
|
||
|
5FE0000
|
trusted library allocation
|
page execute and read and write
|
||
|
14E0000
|
heap
|
page read and write
|
||
|
5DC2000
|
heap
|
page read and write
|
||
|
59CF000
|
stack
|
page read and write
|
||
|
3E9E000
|
direct allocation
|
page read and write
|
||
|
AAF000
|
unkown
|
page write copy
|
||
|
13A4000
|
heap
|
page read and write
|
||
|
14AF000
|
heap
|
page read and write
|
||
|
306A000
|
trusted library allocation
|
page execute and read and write
|
||
|
1E2E000
|
stack
|
page read and write
|
||
|
14A1000
|
heap
|
page read and write
|
||
|
3CB0000
|
direct allocation
|
page read and write
|
||
|
1220000
|
heap
|
page read and write
|
||
|
3040000
|
trusted library allocation
|
page read and write
|
||
|
12AF000
|
heap
|
page read and write
|
||
|
3DD9000
|
direct allocation
|
page read and write
|
||
|
1238000
|
heap
|
page read and write
|
||
|
6EA4000
|
trusted library allocation
|
page read and write
|
||
|
3411000
|
trusted library allocation
|
page read and write
|
||
|
5A30000
|
heap
|
page execute and read and write
|
||
|
554E000
|
stack
|
page read and write
|
||
|
13E0000
|
heap
|
page read and write
|
||
|
1478000
|
heap
|
page read and write
|
||
|
58CE000
|
stack
|
page read and write
|
||
|
344A000
|
trusted library allocation
|
page read and write
|
||
|
AB8000
|
unkown
|
page readonly
|
||
|
1358000
|
stack
|
page read and write
|
||
|
3E4E000
|
direct allocation
|
page read and write
|
||
|
3DDD000
|
direct allocation
|
page read and write
|
||
|
30DE000
|
stack
|
page read and write
|
||
|
3C33000
|
direct allocation
|
page read and write
|
||
|
3D00000
|
direct allocation
|
page read and write
|
||
|
544C000
|
stack
|
page read and write
|
||
|
14E4000
|
heap
|
page read and write
|
||
|
3453000
|
trusted library allocation
|
page read and write
|
||
|
75B0000
|
heap
|
page read and write
|
||
|
5A46000
|
trusted library allocation
|
page read and write
|
||
|
98E000
|
stack
|
page read and write
|
||
|
445000
|
system
|
page execute and read and write
|
||
|
AB3000
|
unkown
|
page write copy
|
||
|
1470000
|
heap
|
page read and write
|
||
|
5A20000
|
trusted library allocation
|
page read and write
|
||
|
3050000
|
heap
|
page read and write
|
||
|
1394000
|
heap
|
page read and write
|
||
|
5A6D000
|
trusted library allocation
|
page read and write
|
||
|
6FF0000
|
trusted library allocation
|
page read and write
|
||
|
3C83000
|
direct allocation
|
page read and write
|
||
|
3C33000
|
direct allocation
|
page read and write
|
||
|
94D000
|
stack
|
page read and write
|
||
|
6FE0000
|
trusted library allocation
|
page read and write
|
||
|
1550000
|
heap
|
page read and write
|
||
|
3E2D000
|
direct allocation
|
page read and write
|
||
|
5B20000
|
heap
|
page read and write
|
||
|
426000
|
system
|
page execute and read and write
|
||
|
3E9E000
|
direct allocation
|
page read and write
|
||
|
3E9E000
|
direct allocation
|
page read and write
|
||
|
1A2E000
|
stack
|
page read and write
|
||
|
3760000
|
direct allocation
|
page read and write
|
||
|
66DE000
|
stack
|
page read and write
|
||
|
A7F000
|
unkown
|
page readonly
|
||
|
11CF000
|
stack
|
page read and write
|
||
|
30F0000
|
heap
|
page read and write
|
||
|
3100000
|
heap
|
page read and write
|
||
|
3020000
|
trusted library allocation
|
page read and write
|
||
|
AB8000
|
unkown
|
page readonly
|
||
|
1384000
|
heap
|
page read and write
|
||
|
7360000
|
trusted library allocation
|
page execute and read and write
|
||
|
1270000
|
heap
|
page read and write
|
||
|
1230000
|
heap
|
page read and write
|
||
|
6D5E000
|
stack
|
page read and write
|
||
|
900000
|
heap
|
page read and write
|
||
|
6EC0000
|
trusted library allocation
|
page read and write
|
||
|
13B0000
|
heap
|
page read and write
|
||
|
5A66000
|
trusted library allocation
|
page read and write
|
||
|
37C0000
|
heap
|
page read and write
|
||
|
5A5A000
|
trusted library allocation
|
page read and write
|
||
|
3C83000
|
direct allocation
|
page read and write
|
||
|
681E000
|
stack
|
page read and write
|
||
|
3400000
|
heap
|
page read and write
|
||
|
3062000
|
trusted library allocation
|
page read and write
|
||
|
13A4000
|
heap
|
page read and write
|
||
|
AA5000
|
unkown
|
page readonly
|
||
|
5EBE000
|
stack
|
page read and write
|
||
|
3077000
|
trusted library allocation
|
page execute and read and write
|
||
|
3D00000
|
direct allocation
|
page read and write
|
||
|
3033000
|
trusted library allocation
|
page execute and read and write
|
||
|
32E0000
|
trusted library allocation
|
page read and write
|
||
|
12CC000
|
heap
|
page read and write
|
||
|
3010000
|
trusted library section
|
page read and write
|
||
|
1270000
|
heap
|
page read and write
|
||
|
14F8000
|
heap
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
5A5E000
|
trusted library allocation
|
page read and write
|
||
|
32F0000
|
heap
|
page read and write
|
||
|
32C0000
|
heap
|
page execute and read and write
|
||
|
1384000
|
heap
|
page read and write
|
||
|
5D5C000
|
stack
|
page read and write
|
There are 206 hidden memdumps, click here to show them.