IOC Report
LisectAVT_2403002A_134.exe

loading gif

Files

File Path
Type
Category
Malicious
LisectAVT_2403002A_134.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\LisectAVT_2403002A_134.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\LisectAVT_2403002A_134.exe
"C:\Users\user\Desktop\LisectAVT_2403002A_134.exe"
 malicious
C:\Users\user\Desktop\LisectAVT_2403002A_134.exe
"C:\Users\user\Desktop\LisectAVT_2403002A_134.exe"
 malicious

URLs

Name
IP
Malicious
http://ftp.normagroup.com.tr
unknown
https://account.dyn.com/
unknown
https://fsf.org/
unknown
https://www.gnu.org/licenses/why-not-lgpl.html
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://download.alegsoftware.ga/ws_switches/contatore/ltromatic.ttf
unknown
https://www.gnu.org/licenses/
unknown

Domains

Name
IP
Malicious
ftp.normagroup.com.tr
104.247.165.99
 malicious

IPs

IP
Domain
Country
Malicious
104.247.165.99
ftp.normagroup.com.tr
United States
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_134_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_134_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_134_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_134_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_134_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_134_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_134_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_134_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_134_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_134_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_134_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_134_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_134_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\LisectAVT_2403002A_134_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2E1E000
trusted library allocation
page read and write
 malicious
2DD1000
trusted library allocation
page read and write
 malicious
3C7E000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
5295000
heap
page read and write
A5E000
heap
page read and write
F50000
heap
page read and write
6E4E000
stack
page read and write
51A0000
heap
page read and write
5810000
trusted library allocation
page read and write
11E1000
heap
page read and write
4ECD000
stack
page read and write
1340000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
525C000
stack
page read and write
FE4000
trusted library allocation
page read and write
6250000
trusted library allocation
page read and write
55D0000
heap
page read and write
51F0000
heap
page execute and read and write
EEE000
stack
page read and write
FF0000
trusted library allocation
page read and write
7010000
trusted library section
page read and write
BB8000
stack
page read and write
2990000
heap
page read and write
100A000
trusted library allocation
page execute and read and write
6F4D000
stack
page read and write
718F000
stack
page read and write
A7A000
heap
page read and write
4F06000
trusted library allocation
page read and write
523B000
stack
page read and write
2975000
trusted library allocation
page read and write
6A00000
trusted library allocation
page read and write
EF3000
trusted library allocation
page execute and read and write
4EE4000
trusted library allocation
page read and write
101B000
trusted library allocation
page execute and read and write
112E000
stack
page read and write
6D40000
heap
page read and write
9F0000
heap
page read and write
977000
stack
page read and write
55FE000
stack
page read and write
C5E000
stack
page read and write
F90000
trusted library allocation
page execute and read and write
F0D000
trusted library allocation
page execute and read and write
5280000
trusted library allocation
page read and write
63AB000
trusted library allocation
page read and write
6BFE000
stack
page read and write
5280000
heap
page read and write
9F2E000
stack
page read and write
6890000
heap
page read and write
3DD1000
trusted library allocation
page read and write
4F70000
heap
page read and write
542000
unkown
page readonly
1002000
trusted library allocation
page read and write
4F90000
trusted library allocation
page read and write
5270000
heap
page read and write
F16000
trusted library allocation
page execute and read and write
1006000
trusted library allocation
page execute and read and write
2DB0000
trusted library allocation
page read and write
A50000
heap
page read and write
4EE0000
trusted library allocation
page read and write
1175000
heap
page read and write
6CD0000
trusted library allocation
page read and write
3B93000
trusted library allocation
page read and write
FFD000
trusted library allocation
page execute and read and write
6390000
trusted library allocation
page read and write
540000
unkown
page readonly
1177000
heap
page read and write
5600000
trusted library section
page read and write
28A0000
trusted library allocation
page read and write
1366000
heap
page read and write
2BC0000
heap
page read and write
1012000
trusted library allocation
page read and write
8937000
trusted library allocation
page read and write
F40000
trusted library allocation
page read and write
4F30000
trusted library allocation
page read and write
2D7B000
trusted library allocation
page read and write
51B0000
heap
page read and write
F00000
trusted library allocation
page read and write
2970000
trusted library allocation
page read and write
62AD000
stack
page read and write
3AA9000
trusted library allocation
page read and write
F3E000
stack
page read and write
F60000
heap
page read and write
A9A000
heap
page read and write
4F80000
heap
page read and write
4F01000
trusted library allocation
page read and write
1140000
heap
page read and write
1000000
trusted library allocation
page read and write
4B9C000
stack
page read and write
11C4000
heap
page read and write
EF0000
trusted library allocation
page read and write
28B0000
heap
page execute and read and write
68D6000
heap
page read and write
6D1E000
stack
page read and write
6CDE000
stack
page read and write
F1A000
trusted library allocation
page execute and read and write
6BD0000
heap
page read and write
C9E000
stack
page read and write
A4E000
stack
page read and write
2900000
trusted library allocation
page read and write
5190000
trusted library section
page readonly
6990000
trusted library allocation
page execute and read and write
2D70000
trusted library allocation
page read and write
F22000
trusted library allocation
page read and write
5260000
trusted library section
page read and write
3B45000
trusted library allocation
page read and write
2B0A000
trusted library allocation
page read and write
127E000
stack
page read and write
5290000
heap
page read and write
6256000
trusted library allocation
page read and write
6DAE000
stack
page read and write
AB9000
stack
page read and write
5170000
trusted library allocation
page read and write
87A000
stack
page read and write
2E42000
trusted library allocation
page read and write
6D10000
trusted library allocation
page read and write
5470000
heap
page read and write
1017000
trusted library allocation
page execute and read and write
2D9D000
trusted library allocation
page read and write
2E1C000
trusted library allocation
page read and write
2B12000
trusted library allocation
page read and write
5380000
heap
page execute and read and write
5270000
trusted library allocation
page execute and read and write
55CC000
stack
page read and write
10AE000
stack
page read and write
5264000
heap
page read and write
6C5E000
stack
page read and write
4EFE000
trusted library allocation
page read and write
E20000
heap
page read and write
5450000
heap
page read and write
EF4000
trusted library allocation
page read and write
2BB0000
trusted library allocation
page read and write
1360000
heap
page read and write
6C9E000
stack
page read and write
F40000
heap
page read and write
11B1000
heap
page read and write
3AF7000
trusted library allocation
page read and write
2910000
trusted library allocation
page execute and read and write
1015000
trusted library allocation
page execute and read and write
A97000
heap
page read and write
6260000
trusted library allocation
page execute and read and write
72D2000
trusted library allocation
page read and write
4FB0000
trusted library allocation
page execute and read and write
7820000
heap
page read and write
3DD9000
trusted library allocation
page read and write
5063000
heap
page read and write
2AA1000
trusted library allocation
page read and write
3DF9000
trusted library allocation
page read and write
9E0000
heap
page read and write
1020000
heap
page read and write
6240000
heap
page read and write
51C0000
trusted library allocation
page read and write
2905000
trusted library allocation
page read and write
6230000
trusted library allocation
page read and write
5260000
heap
page read and write
2BB4000
trusted library allocation
page read and write
FA0000
heap
page read and write
68EC000
heap
page read and write
2890000
trusted library allocation
page read and write
4F0D000
trusted library allocation
page read and write
2B01000
trusted library allocation
page read and write
5060000
heap
page read and write
EFD000
trusted library allocation
page execute and read and write
B14000
heap
page read and write
5818000
trusted library allocation
page read and write
DEE000
stack
page read and write
2980000
trusted library allocation
page read and write
2D7E000
trusted library allocation
page read and write
A58000
heap
page read and write
62B0000
trusted library allocation
page read and write
FA7000
heap
page read and write
623C000
trusted library allocation
page read and write
781F000
stack
page read and write
F2B000
trusted library allocation
page execute and read and write
69FE000
stack
page read and write
4F9B000
trusted library allocation
page read and write
2CCE000
stack
page read and write
F10000
trusted library allocation
page read and write
CD0000
trusted library allocation
page read and write
295D000
stack
page read and write
543E000
stack
page read and write
FE3000
trusted library allocation
page execute and read and write
2DC0000
heap
page execute and read and write
5240000
trusted library allocation
page read and write
6EAF000
stack
page read and write
A88000
heap
page read and write
2B90000
trusted library allocation
page read and write
288C000
stack
page read and write
11CE000
heap
page read and write
2D96000
trusted library allocation
page read and write
3E39000
trusted library allocation
page read and write
2BA0000
trusted library allocation
page read and write
62B7000
trusted library allocation
page read and write
654E000
stack
page read and write
4EEB000
trusted library allocation
page read and write
688E000
stack
page read and write
4FA0000
trusted library allocation
page execute and read and write
2E2C000
trusted library allocation
page read and write
63A0000
trusted library allocation
page read and write
2E3E000
trusted library allocation
page read and write
68B0000
heap
page read and write
2CD8000
trusted library allocation
page read and write
7FCA0000
trusted library allocation
page execute and read and write
3AA1000
trusted library allocation
page read and write
2B4E000
stack
page read and write
6BDE000
heap
page read and write
1350000
trusted library allocation
page execute and read and write
F03000
trusted library allocation
page read and write
A02E000
stack
page read and write
2B8C000
stack
page read and write
2960000
trusted library allocation
page read and write
B43000
heap
page read and write
28FE000
stack
page read and write
5610000
trusted library allocation
page execute and read and write
2D8E000
trusted library allocation
page read and write
F55000
heap
page read and write
678E000
stack
page read and write
1148000
heap
page read and write
F8E000
stack
page read and write
6A20000
trusted library allocation
page execute and read and write
4F92000
trusted library allocation
page read and write
5440000
heap
page read and write
FE0000
trusted library allocation
page read and write
2A9E000
stack
page read and write
56FE000
unkown
page read and write
2B29000
trusted library allocation
page read and write
FD0000
trusted library allocation
page read and write
6D6E000
stack
page read and write
CE0000
heap
page read and write
2D91000
trusted library allocation
page read and write
2AE2000
trusted library allocation
page read and write
2D82000
trusted library allocation
page read and write
A00000
heap
page read and write
FED000
trusted library allocation
page execute and read and write
6A10000
heap
page read and write
F27000
trusted library allocation
page execute and read and write
There are 226 hidden memdumps, click here to show them.