IOC Report
rcrypt.exe

loading gif

Files

File Path
Type
Category
Malicious
rcrypt.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\Montevideo
ASCII text, with very long lines (28674), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\aut63AD.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut640C.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\holloing
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\rcrypt.exe
"C:\Users\user\Desktop\rcrypt.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\rcrypt.exe"
 malicious

URLs

Name
IP
Malicious
https://www.office.com/
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://sectigo.com/CPS0
unknown
https://api.telegram.org
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://api.telegram.org/bot
unknown
https://www.office.com/lB
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://checkip.dyndns.org
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.96.3
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:849224%0D%0ADate%20and%20Time:%2025/07/2024%20/%2001:28:13%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20849224%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D
149.154.167.220
https://api.telegram.org/bot/sendMessage?chat_id=&text=
unknown
https://chrome.google.com/webstore?hl=en
unknown
https://www.ecosia.org/newtab/
unknown
http://varders.kozow.com:8081
unknown
http://aborters.duckdns.org:8081
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://mail.logosbd.net
unknown
http://checkip.dyndns.org/
158.101.44.242
http://51.38.247.67:8081/_send_.php?L
unknown
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://anotherarmy.dns.army:8081
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://checkip.dyndns.org/q
unknown
https://reallyfreegeoip.org
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://logosbd.net
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:849224%0D%0ADate%20a
unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 23 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.96.3
 malicious
api.telegram.org
149.154.167.220
 malicious
mail.logosbd.net
unknown
 malicious
checkip.dyndns.org
unknown
 malicious
bg.microsoft.map.fastly.net
199.232.214.172
checkip.dyndns.com
158.101.44.242

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
malicious
188.114.96.3
reallyfreegeoip.org
European Union
malicious
202.4.96.3
unknown
Bangladesh
158.101.44.242
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
4006000
trusted library allocation
page read and write
 malicious
2A39000
heap
page read and write
 malicious
2F61000
trusted library allocation
page read and write
 malicious
2E60000
trusted library section
page read and write
 malicious
2B60000
trusted library section
page read and write
 malicious
36B9000
direct allocation
page read and write
AE2000
heap
page read and write
2A00000
trusted library allocation
page read and write
40B0000
trusted library allocation
page read and write
377E000
direct allocation
page read and write
2E5E000
stack
page read and write
3243000
trusted library allocation
page read and write
E45000
heap
page read and write
3021000
trusted library allocation
page read and write
3709000
direct allocation
page read and write
2CEE000
stack
page read and write
9DC000
stack
page read and write
DA3000
trusted library allocation
page read and write
5550000
trusted library allocation
page execute and read and write
5610000
heap
page read and write
6790000
trusted library allocation
page read and write
BF3000
heap
page read and write
32E6000
trusted library allocation
page read and write
310000
heap
page read and write
31B9000
trusted library allocation
page read and write
2880000
trusted library allocation
page read and write
53A0000
trusted library allocation
page read and write
370D000
direct allocation
page read and write
5560000
trusted library allocation
page read and write
A82000
heap
page read and write
42B2000
trusted library allocation
page read and write
3113000
trusted library allocation
page read and write
40E4000
trusted library allocation
page read and write
168E000
stack
page read and write
2D50000
heap
page read and write
DC7000
trusted library allocation
page execute and read and write
3428000
trusted library allocation
page read and write
3440000
direct allocation
page read and write
FDF000
stack
page read and write
A8B000
heap
page read and write
370D000
direct allocation
page read and write
2D0E000
trusted library allocation
page read and write
9CE000
stack
page read and write
42BD000
trusted library allocation
page read and write
676E000
stack
page read and write
42B7000
trusted library allocation
page read and write
C75000
heap
page read and write
DCB000
trusted library allocation
page execute and read and write
C37000
trusted library allocation
page read and write
30E0000
trusted library allocation
page read and write
30E8000
trusted library allocation
page read and write
33F0000
direct allocation
page read and write
3060000
heap
page read and write
2F2C000
trusted library allocation
page read and write
3064000
heap
page read and write
3440000
direct allocation
page read and write
372E000
direct allocation
page read and write
304C000
trusted library allocation
page read and write
5A7D000
trusted library allocation
page read and write
2CF0000
heap
page execute and read and write
42AE000
trusted library allocation
page read and write
6870000
trusted library allocation
page read and write
36BD000
direct allocation
page read and write
4082000
trusted library allocation
page read and write
33B0000
direct allocation
page read and write
DA0000
trusted library allocation
page read and write
3563000
direct allocation
page read and write
2D1A000
trusted library allocation
page read and write
C00000
heap
page read and write
30FF000
trusted library allocation
page read and write
BFE000
stack
page read and write
AE2000
heap
page read and write
1210000
heap
page read and write
A5A000
stack
page read and write
C20000
trusted library allocation
page read and write
2EF0000
trusted library allocation
page execute and read and write
4340000
trusted library allocation
page read and write
53B0000
trusted library allocation
page execute and read and write
AF4000
heap
page read and write
1B8000
unkown
page readonly
63EE000
stack
page read and write
65EE000
stack
page read and write
6826000
trusted library allocation
page read and write
DB2000
trusted library allocation
page read and write
11F0000
trusted library allocation
page execute and read and write
BD4000
heap
page read and write
2D21000
trusted library allocation
page read and write
16E0000
heap
page read and write
67B0000
trusted library allocation
page read and write
9FC000
stack
page read and write
540A000
heap
page read and write
325C000
trusted library allocation
page read and write
42CC000
trusted library allocation
page read and write
4209000
trusted library allocation
page read and write
2D2D000
trusted library allocation
page read and write
3590000
direct allocation
page read and write
AF3000
heap
page read and write
AF3000
heap
page read and write
29F0000
trusted library allocation
page read and write
C70000
heap
page read and write
DB6000
trusted library allocation
page execute and read and write
3015000
trusted library allocation
page read and write
5A60000
trusted library allocation
page execute and read and write
A8B000
heap
page read and write
6854000
trusted library allocation
page read and write
D9D000
trusted library allocation
page execute and read and write
550D000
stack
page read and write
2FD7000
trusted library allocation
page read and write
3709000
direct allocation
page read and write
30CC000
trusted library allocation
page read and write
40F7000
trusted library allocation
page read and write
2FCD000
trusted library allocation
page read and write
5A4F000
stack
page read and write
DC5000
trusted library allocation
page execute and read and write
3104000
trusted library allocation
page read and write
6860000
trusted library allocation
page read and write
32F0000
trusted library allocation
page read and write
A8C000
heap
page read and write
54A5000
heap
page read and write
36BD000
direct allocation
page read and write
53D0000
heap
page read and write
DE0000
heap
page read and write
53A5000
trusted library allocation
page read and write
33F0000
direct allocation
page read and write
290C000
stack
page read and write
3292000
trusted library allocation
page read and write
35E0000
direct allocation
page read and write
53C0000
heap
page execute and read and write
662E000
stack
page read and write
3F0000
heap
page read and write
2BC0000
trusted library allocation
page read and write
42A1000
trusted library allocation
page read and write
D70000
trusted library section
page read and write
2B5E000
stack
page read and write
65AF000
stack
page read and write
3590000
direct allocation
page read and write
1B8000
unkown
page readonly
2FB6000
trusted library allocation
page read and write
41CB000
trusted library allocation
page read and write
16F0000
direct allocation
page execute and read and write
62EE000
stack
page read and write
3298000
trusted library allocation
page read and write
DBA000
trusted library allocation
page execute and read and write
666E000
stack
page read and write
3FC8000
trusted library allocation
page read and write
DC2000
trusted library allocation
page read and write
128E000
stack
page read and write
D80000
trusted library allocation
page read and write
2EC0000
trusted library allocation
page read and write
D93000
trusted library allocation
page execute and read and write
42C6000
trusted library allocation
page read and write
420C000
trusted library allocation
page read and write
2D26000
trusted library allocation
page read and write
40CE000
trusted library allocation
page read and write
29A000
stack
page read and write
BC0000
heap
page read and write
3249000
trusted library allocation
page read and write
2910000
trusted library allocation
page execute and read and write
3513000
direct allocation
page read and write
1B3000
unkown
page write copy
2F50000
heap
page read and write
BF4000
heap
page read and write
6CA0000
heap
page read and write
1710000
heap
page read and write
35E0000
direct allocation
page read and write
31D3000
trusted library allocation
page read and write
323E000
trusted library allocation
page read and write
F0000
unkown
page readonly
3590000
direct allocation
page read and write
F1000
unkown
page execute read
4356000
trusted library allocation
page read and write
3F61000
trusted library allocation
page read and write
377E000
direct allocation
page read and write
2D0B000
trusted library allocation
page read and write
32EC000
trusted library allocation
page read and write
539E000
stack
page read and write
DAD000
trusted library allocation
page execute and read and write
30BC000
trusted library allocation
page read and write
AF3000
heap
page read and write
6770000
trusted library allocation
page execute and read and write
53DC000
heap
page read and write
2D06000
trusted library allocation
page read and write
F1000
unkown
page execute read
3440000
direct allocation
page read and write
372E000
direct allocation
page read and write
3563000
direct allocation
page read and write
17F000
unkown
page readonly
BF3000
heap
page read and write
310E000
trusted library allocation
page read and write
3252000
trusted library allocation
page read and write
53D4000
heap
page read and write
A8C000
heap
page read and write
32D0000
trusted library allocation
page read and write
422C000
trusted library allocation
page read and write
4233000
trusted library allocation
page read and write
372E000
direct allocation
page read and write
E10000
heap
page read and write
3108000
trusted library allocation
page read and write
2938000
trusted library allocation
page read and write
D50000
heap
page read and write
3513000
direct allocation
page read and write
2F2A000
trusted library allocation
page read and write
328C000
trusted library allocation
page read and write
B63000
heap
page read and write
41B6000
trusted library allocation
page read and write
426000
system
page execute and read and write
2F42000
trusted library allocation
page read and write
3709000
direct allocation
page read and write
2D32000
trusted library allocation
page read and write
1A5000
unkown
page readonly
A84000
heap
page read and write
3FD9000
trusted library allocation
page read and write
BF3000
heap
page read and write
67A0000
trusted library allocation
page execute and read and write
2F20000
trusted library allocation
page read and write
301D000
trusted library allocation
page read and write
400000
system
page execute and read and write
33F0000
direct allocation
page read and write
594E000
stack
page read and write
3019000
trusted library allocation
page read and write
E56000
heap
page read and write
3117000
trusted library allocation
page read and write
D94000
trusted library allocation
page read and write
4123000
trusted library allocation
page read and write
BB0000
heap
page read and write
C30000
trusted library allocation
page read and write
BD5000
heap
page read and write
28CE000
stack
page read and write
1AF000
unkown
page write copy
17F000
unkown
page readonly
3563000
direct allocation
page read and write
6780000
trusted library allocation
page execute and read and write
41DE000
trusted library allocation
page read and write
53D2000
heap
page read and write
A8C000
heap
page read and write
5A50000
trusted library allocation
page execute and read and write
35E0000
direct allocation
page read and write
DE8000
heap
page read and write
300D000
trusted library allocation
page read and write
4238000
trusted library allocation
page read and write
407E000
trusted library allocation
page read and write
E98000
heap
page read and write
2A10000
heap
page read and write
3285000
trusted library allocation
page read and write
AD3000
heap
page read and write
2FDF000
trusted library allocation
page read and write
AE4000
heap
page read and write
3FEE000
trusted library allocation
page read and write
AF3000
heap
page read and write
3025000
trusted library allocation
page read and write
B4A000
heap
page read and write
4395000
trusted library allocation
page read and write
3513000
direct allocation
page read and write
AD2000
heap
page read and write
124E000
stack
page read and write
64AE000
stack
page read and write
BD4000
heap
page read and write
2FDB000
trusted library allocation
page read and write
B13000
heap
page read and write
A58000
heap
page read and write
4039000
trusted library allocation
page read and write
9BE000
stack
page read and write
DB0000
trusted library allocation
page read and write
AF3000
heap
page read and write
370D000
direct allocation
page read and write
C50000
trusted library allocation
page read and write
BCA000
heap
page read and write
42A8000
trusted library allocation
page read and write
127E000
stack
page read and write
29D0000
trusted library allocation
page read and write
42C0000
trusted library allocation
page read and write
53F0000
heap
page read and write
306F000
trusted library allocation
page read and write
BE3000
heap
page read and write
3FB3000
trusted library allocation
page read and write
36BD000
direct allocation
page read and write
32EA000
trusted library allocation
page read and write
1A5000
unkown
page readonly
2FC2000
trusted library allocation
page read and write
3005000
trusted library allocation
page read and write
2D35000
trusted library allocation
page read and write
1AF000
unkown
page read and write
32DE000
trusted library allocation
page read and write
3009000
trusted library allocation
page read and write
642E000
stack
page read and write
646E000
stack
page read and write
42E1000
trusted library allocation
page read and write
2923000
heap
page read and write
377E000
direct allocation
page read and write
AE3000
heap
page read and write
B57000
stack
page read and write
40AD000
trusted library allocation
page read and write
3261000
trusted library allocation
page read and write
F0000
unkown
page readonly
429B000
trusted library allocation
page read and write
42BB000
trusted library allocation
page read and write
2EE0000
trusted library allocation
page read and write
2930000
trusted library allocation
page read and write
2920000
heap
page read and write
5433000
heap
page read and write
E1D000
heap
page read and write
4159000
trusted library allocation
page read and write
3011000
trusted library allocation
page read and write
A50000
heap
page read and write
2D1E000
trusted library allocation
page read and write
4226000
trusted library allocation
page read and write
4143000
trusted library allocation
page read and write
C40000
trusted library allocation
page read and write
300000
heap
page read and write
3265000
trusted library allocation
page read and write
32E4000
trusted library allocation
page read and write
43F000
system
page execute and read and write
4369000
trusted library allocation
page read and write
36B9000
direct allocation
page read and write
A3E000
stack
page read and write
53D6000
heap
page read and write
2D00000
trusted library allocation
page read and write
32E1000
trusted library allocation
page read and write
C60000
trusted library section
page read and write
AF2000
heap
page read and write
5A70000
trusted library allocation
page read and write
D90000
trusted library allocation
page read and write
6868000
trusted library allocation
page read and write
36B9000
direct allocation
page read and write
2BE0000
heap
page read and write
There are 315 hidden memdumps, click here to show them.