IOC Report
Deye Union - PO # 23081377.exe

loading gif

Files

File Path
Type
Category
Malicious
Deye Union - PO # 23081377.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\autD352.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\autD382.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\demonetising
ASCII text, with very long lines (28674), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\teer
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Deye Union - PO # 23081377.exe
"C:\Users\user\Desktop\Deye Union - PO # 23081377.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\Deye Union - PO # 23081377.exe"
 malicious

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
132.226.247.73
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.97.3
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.97.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
132.226.247.73

IPs

IP
Domain
Country
Malicious
188.114.97.3
reallyfreegeoip.org
European Union
malicious
132.226.247.73
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2421000
trusted library allocation
page read and write
 malicious
1B2000
system
page execute and read and write
 malicious
3220000
direct allocation
page read and write
 malicious
25EE000
trusted library allocation
page read and write
 malicious
39CD000
direct allocation
page read and write
265A000
trusted library allocation
page read and write
2568000
trusted library allocation
page read and write
3700000
direct allocation
page read and write
4D00000
heap
page execute and read and write
257C000
trusted library allocation
page read and write
4F7000
stack
page read and write
34BB000
trusted library allocation
page read and write
39CD000
direct allocation
page read and write
39CD000
direct allocation
page read and write
6E0000
heap
page read and write
26B1000
trusted library allocation
page read and write
38A0000
direct allocation
page read and write
26AB000
trusted library allocation
page read and write
2665000
trusted library allocation
page read and write
3823000
direct allocation
page read and write
E9B000
heap
page read and write
2678000
trusted library allocation
page read and write
5E80000
trusted library allocation
page execute and read and write
EFD000
heap
page read and write
802000
trusted library allocation
page read and write
5F10000
trusted library allocation
page read and write
5E70000
trusted library allocation
page read and write
25D2000
trusted library allocation
page read and write
4932000
trusted library allocation
page read and write
3700000
direct allocation
page read and write
3A3E000
direct allocation
page read and write
62E000
stack
page read and write
E9B000
heap
page read and write
5E0000
heap
page read and write
32C4000
heap
page read and write
34AF000
trusted library allocation
page read and write
860000
heap
page read and write
3210000
direct allocation
page execute and read and write
382000
unkown
page readonly
3823000
direct allocation
page read and write
E9B000
heap
page read and write
252C000
trusted library allocation
page read and write
E9B000
heap
page read and write
E58000
heap
page read and write
22C0000
heap
page read and write
3823000
direct allocation
page read and write
3700000
direct allocation
page read and write
38A0000
direct allocation
page read and write
39C9000
direct allocation
page read and write
258A000
trusted library allocation
page read and write
256C000
trusted library allocation
page read and write
267D000
trusted library allocation
page read and write
5F70000
heap
page read and write
241F000
stack
page read and write
3A3E000
direct allocation
page read and write
39C9000
direct allocation
page read and write
E9B000
heap
page read and write
2C1000
unkown
page execute read
E84000
heap
page read and write
6D0000
trusted library allocation
page read and write
32C0000
heap
page read and write
2560000
trusted library allocation
page read and write
26B7000
trusted library allocation
page read and write
BDB000
stack
page read and write
39C9000
direct allocation
page read and write
2253000
heap
page read and write
394000
unkown
page readonly
BFF000
stack
page read and write
2250000
heap
page read and write
80A000
trusted library allocation
page execute and read and write
22BE000
stack
page read and write
3823000
direct allocation
page read and write
E94000
heap
page read and write
812000
trusted library allocation
page read and write
17A000
stack
page read and write
39CD000
direct allocation
page read and write
D4E000
stack
page read and write
5E58000
trusted library allocation
page read and write
F1A000
heap
page read and write
918000
heap
page read and write
D50000
heap
page read and write
4E0F000
stack
page read and write
8E7000
heap
page read and write
3823000
direct allocation
page read and write
820000
heap
page read and write
39C9000
direct allocation
page read and write
4906000
trusted library allocation
page read and write
81B000
trusted library allocation
page execute and read and write
2520000
trusted library allocation
page read and write
EE1000
heap
page read and write
2528000
trusted library allocation
page read and write
2516000
trusted library allocation
page read and write
670000
heap
page read and write
39C9000
direct allocation
page read and write
BEF000
stack
page read and write
5A26000
heap
page read and write
3823000
direct allocation
page read and write
E94000
heap
page read and write
5E50000
trusted library allocation
page read and write
4921000
trusted library allocation
page read and write
25B2000
trusted library allocation
page read and write
589E000
stack
page read and write
4A80000
heap
page read and write
24E9000
trusted library allocation
page read and write
59A0000
heap
page read and write
E7A000
heap
page read and write
5E30000
trusted library allocation
page execute and read and write
BCF000
stack
page read and write
5E20000
trusted library allocation
page read and write
34A5000
trusted library allocation
page read and write
3823000
direct allocation
page read and write
1B0000
system
page execute and read and write
7FD000
trusted library allocation
page execute and read and write
2C0000
unkown
page readonly
8FC000
heap
page read and write
5EB0000
trusted library allocation
page read and write
492D000
trusted library allocation
page read and write
E95000
heap
page read and write
5F40000
heap
page read and write
2240000
trusted library allocation
page read and write
2574000
trusted library allocation
page read and write
164E000
stack
page read and write
EEE000
heap
page read and write
25CE000
trusted library allocation
page read and write
3A3E000
direct allocation
page read and write
5F60000
trusted library allocation
page execute and read and write
815000
trusted library allocation
page execute and read and write
6DD000
trusted library allocation
page execute and read and write
5E56000
trusted library allocation
page read and write
26E8000
trusted library allocation
page read and write
E9B000
heap
page read and write
2524000
trusted library allocation
page read and write
38C000
unkown
page write copy
800000
trusted library allocation
page read and write
5E90000
trusted library allocation
page execute and read and write
EFB000
heap
page read and write
2564000
trusted library allocation
page read and write
6A0000
heap
page read and write
5E60000
trusted library allocation
page execute and read and write
7EE000
stack
page read and write
5F0000
heap
page read and write
5E40000
trusted library allocation
page read and write
348A000
trusted library allocation
page read and write
39CD000
direct allocation
page read and write
499E000
stack
page read and write
59FE000
heap
page read and write
24D2000
trusted library allocation
page read and write
E93000
heap
page read and write
2260000
trusted library allocation
page read and write
5E4E000
trusted library allocation
page read and write
87E000
heap
page read and write
24E6000
trusted library allocation
page read and write
4900000
trusted library allocation
page read and write
24CC000
trusted library allocation
page read and write
3700000
direct allocation
page read and write
F1A000
heap
page read and write
1A4E000
stack
page read and write
38C000
unkown
page read and write
817000
trusted library allocation
page execute and read and write
390000
unkown
page write copy
24DD000
trusted library allocation
page read and write
31F0000
heap
page read and write
26A5000
trusted library allocation
page read and write
E50000
heap
page read and write
EEE000
heap
page read and write
5ADD000
stack
page read and write
5B1E000
stack
page read and write
D0E000
stack
page read and write
35C000
unkown
page readonly
E84000
heap
page read and write
2C0000
unkown
page readonly
599E000
stack
page read and write
266F000
trusted library allocation
page read and write
579000
stack
page read and write
265F000
trusted library allocation
page read and write
5E7F000
trusted library allocation
page read and write
5B5E000
stack
page read and write
24DA000
trusted library allocation
page read and write
5EA0000
trusted library allocation
page read and write
2578000
trusted library allocation
page read and write
901000
heap
page read and write
EE1000
heap
page read and write
E7A000
heap
page read and write
F2A000
heap
page read and write
39CD000
direct allocation
page read and write
E94000
heap
page read and write
382000
unkown
page readonly
6D4000
trusted library allocation
page read and write
3A3E000
direct allocation
page read and write
45BE000
stack
page read and write
5C9E000
stack
page read and write
25A5000
trusted library allocation
page read and write
5C5E000
stack
page read and write
3421000
trusted library allocation
page read and write
3A3E000
direct allocation
page read and write
E73000
heap
page read and write
7F0000
trusted library allocation
page read and write
3449000
trusted library allocation
page read and write
2570000
trusted library allocation
page read and write
5E73000
trusted library allocation
page read and write
491E000
trusted library allocation
page read and write
24D4000
trusted library allocation
page read and write
6D3000
trusted library allocation
page execute and read and write
EE1000
heap
page read and write
35C000
unkown
page readonly
F3A000
heap
page read and write
223E000
stack
page read and write
6E5000
heap
page read and write
BBF000
stack
page read and write
E9C000
heap
page read and write
24C9000
trusted library allocation
page read and write
3A3E000
direct allocation
page read and write
E9B000
heap
page read and write
3700000
direct allocation
page read and write
39C9000
direct allocation
page read and write
850000
trusted library allocation
page execute and read and write
2310000
heap
page read and write
E97000
heap
page read and write
38A0000
direct allocation
page read and write
5D1E000
stack
page read and write
E82000
heap
page read and write
38A0000
direct allocation
page read and write
2597000
trusted library allocation
page read and write
5A0C000
heap
page read and write
510000
heap
page read and write
2C1000
unkown
page execute read
2501000
trusted library allocation
page read and write
951000
heap
page read and write
EE1000
heap
page read and write
38A0000
direct allocation
page read and write
2270000
heap
page execute and read and write
39C9000
direct allocation
page read and write
EEE000
heap
page read and write
E94000
heap
page read and write
F2A000
heap
page read and write
394000
unkown
page readonly
3A3E000
direct allocation
page read and write
26AD000
trusted library allocation
page read and write
3700000
direct allocation
page read and write
806000
trusted library allocation
page execute and read and write
490B000
trusted library allocation
page read and write
3700000
direct allocation
page read and write
490E000
trusted library allocation
page read and write
F2A000
heap
page read and write
5E1E000
stack
page read and write
5CDE000
stack
page read and write
DC0000
heap
page read and write
899000
heap
page read and write
4926000
trusted library allocation
page read and write
2681000
trusted library allocation
page read and write
E97000
heap
page read and write
491A000
trusted library allocation
page read and write
F2A000
heap
page read and write
39CD000
direct allocation
page read and write
2300000
trusted library allocation
page read and write
6C0000
trusted library allocation
page read and write
38A0000
direct allocation
page read and write
25E0000
trusted library allocation
page read and write
5E7A000
trusted library allocation
page read and write
5E5B000
trusted library allocation
page read and write
EE1000
heap
page read and write
F1A000
heap
page read and write
38A0000
direct allocation
page read and write
EFB000
heap
page read and write
868000
heap
page read and write
22E0000
trusted library allocation
page read and write
EE1000
heap
page read and write
There are 257 hidden memdumps, click here to show them.