IOC Report
LisectAVT_2403002A_52.exe

loading gif

Files

File Path
Type
Category
Malicious
LisectAVT_2403002A_52.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002A_52.exe.log
ASCII text, with CRLF line terminators
modified
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\LisectAVT_2403002A_52.exe
"C:\Users\user\Desktop\LisectAVT_2403002A_52.exe"
 malicious
C:\Users\user\Desktop\LisectAVT_2403002A_52.exe
"C:\Users\user\Desktop\LisectAVT_2403002A_52.exe"
 malicious

URLs

Name
IP
Malicious
http://smtp.thanhancompony.com
unknown
https://account.dyn.com/
unknown
http://us2.smtp.mailhostbox.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0
unknown
http://tempuri.org/Locations.xsdkServer=ARCHIT;Database=Sample;Trusted_Connection=TrueUPlease
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
ip-api.com
208.95.112.1
 malicious
smtp.thanhancompony.com
unknown
 malicious
us2.smtp.mailhostbox.com
208.91.198.143

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
malicious
208.91.198.143
us2.smtp.mailhostbox.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_52_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_52_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_52_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_52_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_52_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_52_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_52_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_52_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_52_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_52_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_52_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_52_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_52_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_52_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
29AE000
trusted library allocation
page read and write
 malicious
2981000
trusted library allocation
page read and write
 malicious
369E000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
6620000
heap
page read and write
4904000
trusted library allocation
page read and write
983E000
stack
page read and write
BA13000
trusted library allocation
page read and write
4C30000
heap
page execute and read and write
A86E000
heap
page read and write
24BE000
stack
page read and write
852000
trusted library allocation
page read and write
BA27000
trusted library allocation
page read and write
D80000
heap
page read and write
5600000
trusted library allocation
page read and write
856000
trusted library allocation
page execute and read and write
610E000
stack
page read and write
6C10000
trusted library allocation
page read and write
4A10000
heap
page read and write
29B4000
trusted library allocation
page read and write
3AD8000
trusted library allocation
page read and write
83D000
trusted library allocation
page execute and read and write
28E0000
trusted library allocation
page read and write
3B98000
trusted library allocation
page read and write
713E000
stack
page read and write
29D6000
trusted library allocation
page read and write
4960000
trusted library allocation
page read and write
696F000
stack
page read and write
4926000
trusted library allocation
page read and write
D5D000
trusted library allocation
page execute and read and write
5060000
heap
page execute and read and write
BA4A000
trusted library allocation
page read and write
723E000
stack
page read and write
AB0000
trusted library allocation
page read and write
BA2C000
trusted library allocation
page read and write
3B38000
trusted library allocation
page read and write
5520000
heap
page read and write
2737000
trusted library allocation
page execute and read and write
4958000
trusted library allocation
page read and write
4AEE000
stack
page read and write
D76000
trusted library allocation
page execute and read and write
69AC000
stack
page read and write
662E000
heap
page read and write
DC5000
heap
page read and write
4EFC000
stack
page read and write
2D0E000
trusted library allocation
page read and write
4E6B000
stack
page read and write
935000
heap
page read and write
676E000
stack
page read and write
6BEC000
stack
page read and write
289E000
stack
page read and write
279E000
stack
page read and write
4930000
trusted library allocation
page read and write
3A58000
trusted library allocation
page read and write
4ED0000
trusted library allocation
page read and write
2345000
trusted library allocation
page read and write
39F8000
trusted library allocation
page read and write
2750000
trusted library allocation
page read and write
54B9000
heap
page read and write
4950000
trusted library allocation
page read and write
D40000
trusted library allocation
page read and write
D54000
trusted library allocation
page read and write
993E000
stack
page read and write
B59000
stack
page read and write
A5E000
stack
page read and write
663D000
stack
page read and write
54AC000
stack
page read and write
D87000
heap
page read and write
81E000
stack
page read and write
4F74000
heap
page read and write
6C20000
trusted library allocation
page execute and read and write
2549000
trusted library allocation
page read and write
7000000
heap
page read and write
E2A000
heap
page read and write
233E000
stack
page read and write
6770000
trusted library allocation
page read and write
4F80000
trusted library allocation
page read and write
2735000
trusted library allocation
page execute and read and write
4980000
trusted library allocation
page read and write
CA7000
heap
page read and write
D90000
heap
page read and write
8257000
trusted library allocation
page read and write
D50000
trusted library allocation
page read and write
3A78000
trusted library allocation
page read and write
3AB8000
trusted library allocation
page read and write
CE0000
heap
page read and write
6720000
trusted library allocation
page execute and read and write
BA36000
trusted library allocation
page read and write
4F9E000
trusted library allocation
page read and write
A8DF000
heap
page read and write
BA09000
trusted library allocation
page read and write
3B58000
trusted library allocation
page read and write
85A000
trusted library allocation
page execute and read and write
4F20000
heap
page read and write
24C1000
trusted library allocation
page read and write
C210000
trusted library allocation
page read and write
4F50000
trusted library allocation
page read and write
34C9000
trusted library allocation
page read and write
4F8B000
trusted library allocation
page read and write
868000
heap
page read and write
537000
stack
page read and write
CB0000
heap
page read and write
4A50000
trusted library section
page readonly
116E6000
trusted library allocation
page read and write
D7A000
trusted library allocation
page execute and read and write
45BC000
stack
page read and write
8F9000
heap
page read and write
BA61000
trusted library allocation
page read and write
3BB8000
trusted library allocation
page read and write
4F10000
heap
page read and write
BA00000
trusted library allocation
page read and write
2532000
trusted library allocation
page read and write
678B000
trusted library allocation
page read and write
4F60000
trusted library allocation
page read and write
E19000
heap
page read and write
4FAD000
trusted library allocation
page read and write
4EE0000
trusted library section
page read and write
6D22000
trusted library allocation
page read and write
49D0000
heap
page read and write
4FA1000
trusted library allocation
page read and write
896000
heap
page read and write
6690000
trusted library allocation
page execute and read and write
614E000
stack
page read and write
62A0000
heap
page read and write
23A0000
trusted library allocation
page read and write
BA18000
trusted library allocation
page read and write
49B3000
heap
page read and write
4A29000
trusted library allocation
page read and write
6A70000
trusted library section
page read and write
4CC0000
heap
page read and write
4EC0000
trusted library allocation
page read and write
D6D000
trusted library allocation
page execute and read and write
65D7000
trusted library allocation
page read and write
5070000
heap
page read and write
3B18000
trusted library allocation
page read and write
4F70000
heap
page read and write
6AAC000
stack
page read and write
84D000
trusted library allocation
page execute and read and write
29C0000
trusted library allocation
page read and write
A67000
trusted library allocation
page execute and read and write
BA45000
trusted library allocation
page read and write
833000
trusted library allocation
page execute and read and write
4F54000
trusted library allocation
page read and write
D70000
trusted library allocation
page read and write
624E000
stack
page read and write
DC7000
heap
page read and write
4EF0000
heap
page read and write
55F0000
heap
page read and write
39D8000
trusted library allocation
page read and write
49F0000
trusted library allocation
page execute and read and write
B4C000
stack
page read and write
BA54000
trusted library allocation
page read and write
7DF000
stack
page read and write
65CE000
stack
page read and write
D2C000
stack
page read and write
4940000
trusted library allocation
page read and write
4E90000
trusted library allocation
page execute and read and write
2503000
trusted library allocation
page read and write
65E6000
trusted library allocation
page read and write
4F8E000
trusted library allocation
page read and write
4A30000
trusted library allocation
page read and write
65F0000
trusted library allocation
page read and write
E2E000
heap
page read and write
55ED000
stack
page read and write
840000
trusted library allocation
page read and write
6C30000
heap
page read and write
4EF5000
heap
page read and write
A90000
trusted library allocation
page execute and read and write
C0000
unkown
page readonly
5608000
trusted library allocation
page read and write
92EE000
trusted library allocation
page read and write
F8D000
stack
page read and write
526C000
stack
page read and write
BA4F000
trusted library allocation
page read and write
A710000
heap
page read and write
53AC000
stack
page read and write
54B0000
heap
page read and write
2DAB000
trusted library allocation
page read and write
490B000
trusted library allocation
page read and write
650000
heap
page read and write
29D0000
trusted library allocation
page read and write
4CD0000
heap
page read and write
23B0000
heap
page execute and read and write
A5A000
stack
page read and write
3A98000
trusted library allocation
page read and write
AC0000
heap
page read and write
A62000
trusted library allocation
page read and write
A891000
heap
page read and write
6640000
trusted library allocation
page execute and read and write
A8BC000
heap
page read and write
7010000
trusted library allocation
page read and write
B0E000
stack
page read and write
4F30000
trusted library allocation
page read and write
64CE000
stack
page read and write
65E0000
trusted library allocation
page read and write
2732000
trusted library allocation
page read and write
A8C5000
heap
page read and write
D98000
heap
page read and write
3BF8000
trusted library allocation
page read and write
39B8000
trusted library allocation
page read and write
4A20000
trusted library allocation
page read and write
6276000
heap
page read and write
3565000
trusted library allocation
page read and write
6250000
heap
page read and write
E06000
heap
page read and write
3517000
trusted library allocation
page read and write
4955000
trusted library allocation
page read and write
D72000
trusted library allocation
page read and write
BC0000
heap
page read and write
AA0000
heap
page read and write
28DC000
stack
page read and write
4C2C000
stack
page read and write
2930000
heap
page execute and read and write
29C4000
trusted library allocation
page read and write
5DD0000
heap
page read and write
92E9000
trusted library allocation
page read and write
4F27000
heap
page read and write
5530000
heap
page read and write
AC7000
heap
page read and write
5550000
heap
page read and write
86E000
heap
page read and write
D53000
trusted library allocation
page execute and read and write
570000
heap
page read and write
2730000
trusted library allocation
page read and write
116EE000
trusted library allocation
page read and write
4FB2000
trusted library allocation
page read and write
3A18000
trusted library allocation
page read and write
D60000
trusted library allocation
page read and write
8A3000
heap
page read and write
5CCC000
stack
page read and write
2920000
trusted library allocation
page execute and read and write
4EA0000
trusted library section
page read and write
500C000
stack
page read and write
16C000
unkown
page readonly
2522000
trusted library allocation
page read and write
65FD000
trusted library allocation
page read and write
7F1C0000
trusted library allocation
page execute and read and write
A81D000
heap
page read and write
B50000
heap
page read and write
2940000
heap
page read and write
691E000
stack
page read and write
6BEE000
stack
page read and write
492D000
trusted library allocation
page read and write
4EB0000
trusted library allocation
page execute and read and write
A8B5000
heap
page read and write
C2000
unkown
page readonly
860000
heap
page read and write
400000
remote allocation
page execute and read and write
4EAC000
stack
page read and write
5610000
heap
page read and write
3BD8000
trusted library allocation
page read and write
6D0000
heap
page read and write
668F000
stack
page read and write
2350000
trusted library allocation
page execute and read and write
2951000
trusted library allocation
page read and write
29D4000
trusted library allocation
page read and write
35B3000
trusted library allocation
page read and write
BA40000
trusted library allocation
page read and write
4FA6000
trusted library allocation
page read and write
BA31000
trusted library allocation
page read and write
3951000
trusted library allocation
page read and write
6730000
trusted library allocation
page read and write
68DE000
stack
page read and write
3A38000
trusted library allocation
page read and write
67DE000
stack
page read and write
65D0000
trusted library allocation
page read and write
DBB000
heap
page read and write
A7FD000
heap
page read and write
69E000
stack
page read and write
4932000
trusted library allocation
page read and write
239D000
stack
page read and write
491E000
trusted library allocation
page read and write
A6B000
trusted library allocation
page execute and read and write
4F92000
trusted library allocation
page read and write
29AC000
trusted library allocation
page read and write
43A000
stack
page read and write
CA0000
heap
page read and write
820000
trusted library allocation
page read and write
273B000
trusted library allocation
page execute and read and write
3AF8000
trusted library allocation
page read and write
6AEC000
stack
page read and write
4F40000
trusted library allocation
page read and write
BA22000
trusted library allocation
page read and write
49E0000
trusted library allocation
page read and write
A80000
trusted library allocation
page read and write
2340000
trusted library allocation
page read and write
4921000
trusted library allocation
page read and write
49B0000
heap
page read and write
830000
trusted library allocation
page read and write
5DCE000
stack
page read and write
52AE000
stack
page read and write
BA1D000
trusted library allocation
page read and write
BA3B000
trusted library allocation
page read and write
6A5E000
stack
page read and write
6A1E000
stack
page read and write
BA0E000
trusted library allocation
page read and write
4E7E000
stack
page read and write
252B000
trusted library allocation
page read and write
2900000
trusted library allocation
page read and write
6780000
trusted library allocation
page read and write
5DE0000
heap
page read and write
3979000
trusted library allocation
page read and write
8A1000
heap
page read and write
92E6000
trusted library allocation
page read and write
34C1000
trusted library allocation
page read and write
6790000
trusted library allocation
page read and write
BA04000
trusted library allocation
page read and write
834000
trusted library allocation
page read and write
4900000
trusted library allocation
page read and write
2910000
trusted library allocation
page read and write
116E9000
trusted library allocation
page read and write
850000
trusted library allocation
page read and write
3B78000
trusted library allocation
page read and write
2D81000
trusted library allocation
page read and write
7A10000
trusted library allocation
page read and write
There are 305 hidden memdumps, click here to show them.