Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
LisectAVT_2403002A_1.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\atule
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut1D2B.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut1D8A.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\prespecialist
|
Unicode text, UTF-8 text, with very long lines (29698), with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\LisectAVT_2403002A_1.exe
|
"C:\Users\user\Desktop\LisectAVT_2403002A_1.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\LisectAVT_2403002A_1.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://account.dyn.com/
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://ip-api.com/line/?fields=hosting
|
208.95.112.1
|
||
|
http://ip-api.com
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
ip-api.com
|
208.95.112.1
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
208.95.112.1
|
ip-api.com
|
United States
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
3FD0000
|
direct allocation
|
page read and write
|
|
|
|
402000
|
system
|
page execute and read and write
|
|
|
|
860000
|
trusted library allocation
|
page read and write
|
||
|
2482000
|
trusted library allocation
|
page read and write
|
||
|
42D9000
|
direct allocation
|
page read and write
|
||
|
33B9000
|
trusted library allocation
|
page read and write
|
||
|
4A50000
|
heap
|
page read and write
|
||
|
4D0000
|
heap
|
page read and write
|
||
|
1714000
|
heap
|
page read and write
|
||
|
58BF000
|
stack
|
page read and write
|
||
|
1905000
|
heap
|
page read and write
|
||
|
4EDE000
|
stack
|
page read and write
|
||
|
2380000
|
heap
|
page read and write
|
||
|
4FBE000
|
stack
|
page read and write
|
||
|
2472000
|
trusted library allocation
|
page read and write
|
||
|
1821000
|
heap
|
page read and write
|
||
|
2480000
|
trusted library allocation
|
page read and write
|
||
|
1A9000
|
stack
|
page read and write
|
||
|
1820000
|
heap
|
page read and write
|
||
|
F70000
|
heap
|
page read and write
|
||
|
2391000
|
trusted library allocation
|
page read and write
|
||
|
4060000
|
direct allocation
|
page read and write
|
||
|
460000
|
heap
|
page read and write
|
||
|
15CE000
|
stack
|
page read and write
|
||
|
358000
|
unkown
|
page execute and write copy
|
||
|
5C00000
|
trusted library allocation
|
page execute and read and write
|
||
|
4329000
|
direct allocation
|
page read and write
|
||
|
FDE000
|
stack
|
page read and write
|
||
|
434E000
|
direct allocation
|
page read and write
|
||
|
940000
|
trusted library allocation
|
page read and write
|
||
|
4F0000
|
heap
|
page read and write
|
||
|
8EE000
|
stack
|
page read and write
|
||
|
2406000
|
trusted library allocation
|
page read and write
|
||
|
42D9000
|
direct allocation
|
page read and write
|
||
|
4010000
|
direct allocation
|
page read and write
|
||
|
1905000
|
heap
|
page read and write
|
||
|
33F9000
|
trusted library allocation
|
page read and write
|
||
|
844000
|
trusted library allocation
|
page read and write
|
||
|
2452000
|
trusted library allocation
|
page read and write
|
||
|
2320000
|
trusted library allocation
|
page read and write
|
||
|
2458000
|
trusted library allocation
|
page read and write
|
||
|
1916000
|
heap
|
page read and write
|
||
|
1820000
|
heap
|
page read and write
|
||
|
42DD000
|
direct allocation
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
866000
|
trusted library allocation
|
page execute and read and write
|
||
|
24A2000
|
trusted library allocation
|
page read and write
|
||
|
432D000
|
direct allocation
|
page read and write
|
||
|
85D000
|
trusted library allocation
|
page execute and read and write
|
||
|
84D000
|
trusted library allocation
|
page execute and read and write
|
||
|
58C8000
|
heap
|
page read and write
|
||
|
2494000
|
trusted library allocation
|
page read and write
|
||
|
3AF000
|
unkown
|
page read and write
|
||
|
17D0000
|
heap
|
page read and write
|
||
|
5D00000
|
heap
|
page read and write
|
||
|
439E000
|
direct allocation
|
page read and write
|
||
|
235A000
|
trusted library allocation
|
page read and write
|
||
|
92C000
|
stack
|
page read and write
|
||
|
1710000
|
heap
|
page read and write
|
||
|
1822000
|
heap
|
page read and write
|
||
|
5C50000
|
trusted library allocation
|
page execute and read and write
|
||
|
966000
|
heap
|
page read and write
|
||
|
850000
|
trusted library allocation
|
page read and write
|
||
|
559000
|
heap
|
page read and write
|
||
|
41B0000
|
direct allocation
|
page read and write
|
||
|
4880000
|
heap
|
page read and write
|
||
|
24E0000
|
heap
|
page read and write
|
||
|
1916000
|
heap
|
page read and write
|
||
|
54A000
|
heap
|
page read and write
|
||
|
1916000
|
heap
|
page read and write
|
||
|
4133000
|
direct allocation
|
page read and write
|
||
|
33F000
|
unkown
|
page execute and read and write
|
||
|
4133000
|
direct allocation
|
page read and write
|
||
|
432D000
|
direct allocation
|
page read and write
|
||
|
2490000
|
trusted library allocation
|
page read and write
|
||
|
235E000
|
trusted library allocation
|
page read and write
|
||
|
335000
|
unkown
|
page execute and read and write
|
||
|
4329000
|
direct allocation
|
page read and write
|
||
|
7F650000
|
trusted library allocation
|
page execute and read and write
|
||
|
1848000
|
heap
|
page read and write
|
||
|
4183000
|
direct allocation
|
page read and write
|
||
|
5E5000
|
heap
|
page read and write
|
||
|
2310000
|
trusted library allocation
|
page read and write
|
||
|
1FCE000
|
stack
|
page read and write
|
||
|
180D000
|
heap
|
page read and write
|
||
|
53E000
|
heap
|
page read and write
|
||
|
862000
|
trusted library allocation
|
page read and write
|
||
|
520000
|
heap
|
page read and write
|
||
|
4010000
|
direct allocation
|
page read and write
|
||
|
4B0000
|
heap
|
page read and write
|
||
|
58C0000
|
heap
|
page read and write
|
||
|
3391000
|
trusted library allocation
|
page read and write
|
||
|
5000000
|
trusted library allocation
|
page read and write
|
||
|
5C20000
|
trusted library allocation
|
page read and write
|
||
|
4060000
|
direct allocation
|
page read and write
|
||
|
1700000
|
heap
|
page read and write
|
||
|
1849000
|
heap
|
page read and write
|
||
|
4200000
|
direct allocation
|
page read and write
|
||
|
1905000
|
heap
|
page read and write
|
||
|
182F000
|
heap
|
page read and write
|
||
|
17D7000
|
heap
|
page read and write
|
||
|
5C30000
|
trusted library allocation
|
page read and write
|
||
|
2366000
|
trusted library allocation
|
page read and write
|
||
|
872000
|
trusted library allocation
|
page read and write
|
||
|
41B0000
|
direct allocation
|
page read and write
|
||
|
42D9000
|
direct allocation
|
page read and write
|
||
|
830000
|
trusted library allocation
|
page read and write
|
||
|
5C27000
|
trusted library allocation
|
page read and write
|
||
|
F6E000
|
stack
|
page read and write
|
||
|
4200000
|
direct allocation
|
page read and write
|
||
|
18F5000
|
heap
|
page read and write
|
||
|
950000
|
trusted library allocation
|
page read and write
|
||
|
281000
|
unkown
|
page execute and read and write
|
||
|
528000
|
heap
|
page read and write
|
||
|
452E000
|
stack
|
page read and write
|
||
|
87B000
|
trusted library allocation
|
page execute and read and write
|
||
|
4010000
|
direct allocation
|
page read and write
|
||
|
2361000
|
trusted library allocation
|
page read and write
|
||
|
23C5000
|
trusted library allocation
|
page read and write
|
||
|
23CE000
|
stack
|
page read and write
|
||
|
4FFE000
|
stack
|
page read and write
|
||
|
4A40000
|
heap
|
page read and write
|
||
|
5FC000
|
heap
|
page read and write
|
||
|
4F5000
|
heap
|
page read and write
|
||
|
1916000
|
heap
|
page read and write
|
||
|
15DB000
|
stack
|
page read and write
|
||
|
18CB000
|
heap
|
page read and write
|
||
|
1848000
|
heap
|
page read and write
|
||
|
3399000
|
trusted library allocation
|
page read and write
|
||
|
2340000
|
trusted library allocation
|
page read and write
|
||
|
4DDD000
|
stack
|
page read and write
|
||
|
1848000
|
heap
|
page read and write
|
||
|
49BC000
|
stack
|
page read and write
|
||
|
49D0000
|
heap
|
page execute and read and write
|
||
|
1810000
|
heap
|
page read and write
|
||
|
960000
|
heap
|
page read and write
|
||
|
18F6000
|
heap
|
page read and write
|
||
|
5C17000
|
trusted library allocation
|
page read and write
|
||
|
41B0000
|
direct allocation
|
page read and write
|
||
|
234B000
|
trusted library allocation
|
page read and write
|
||
|
86A000
|
trusted library allocation
|
page execute and read and write
|
||
|
1848000
|
heap
|
page read and write
|
||
|
234E000
|
trusted library allocation
|
page read and write
|
||
|
42DD000
|
direct allocation
|
page read and write
|
||
|
4133000
|
direct allocation
|
page read and write
|
||
|
15FC000
|
stack
|
page read and write
|
||
|
1810000
|
heap
|
page read and write
|
||
|
5C40000
|
trusted library allocation
|
page read and write
|
||
|
15BE000
|
stack
|
page read and write
|
||
|
434E000
|
direct allocation
|
page read and write
|
||
|
4C5E000
|
stack
|
page read and write
|
||
|
42DD000
|
direct allocation
|
page read and write
|
||
|
55B000
|
heap
|
page read and write
|
||
|
4B5C000
|
stack
|
page read and write
|
||
|
2330000
|
heap
|
page execute and read and write
|
||
|
1820000
|
heap
|
page read and write
|
||
|
247C000
|
trusted library allocation
|
page read and write
|
||
|
843000
|
trusted library allocation
|
page execute and read and write
|
||
|
4200000
|
direct allocation
|
page read and write
|
||
|
8A0000
|
trusted library allocation
|
page read and write
|
||
|
4398000
|
trusted library allocation
|
page read and write
|
||
|
A9000
|
stack
|
page read and write
|
||
|
5CE0000
|
trusted library allocation
|
page read and write
|
||
|
F20000
|
heap
|
page read and write
|
||
|
280000
|
unkown
|
page readonly
|
||
|
1805000
|
heap
|
page read and write
|
||
|
432D000
|
direct allocation
|
page read and write
|
||
|
930000
|
trusted library allocation
|
page execute and read and write
|
||
|
1848000
|
heap
|
page read and write
|
||
|
4183000
|
direct allocation
|
page read and write
|
||
|
4C9E000
|
stack
|
page read and write
|
||
|
EBA000
|
stack
|
page read and write
|
||
|
17B0000
|
direct allocation
|
page execute and read and write
|
||
|
1915000
|
heap
|
page read and write
|
||
|
1806000
|
heap
|
page read and write
|
||
|
24A9000
|
trusted library allocation
|
page read and write
|
||
|
4D9E000
|
stack
|
page read and write
|
||
|
1907000
|
heap
|
page read and write
|
||
|
434E000
|
direct allocation
|
page read and write
|
||
|
890000
|
heap
|
page read and write
|
||
|
2352000
|
trusted library allocation
|
page read and write
|
||
|
4060000
|
direct allocation
|
page read and write
|
||
|
4329000
|
direct allocation
|
page read and write
|
||
|
5B3000
|
heap
|
page read and write
|
||
|
1848000
|
heap
|
page read and write
|
||
|
3AE000
|
unkown
|
page execute and write copy
|
||
|
1915000
|
heap
|
page read and write
|
||
|
1916000
|
heap
|
page read and write
|
||
|
840000
|
trusted library allocation
|
page read and write
|
||
|
3AF000
|
unkown
|
page write copy
|
||
|
877000
|
trusted library allocation
|
page execute and read and write
|
||
|
1848000
|
heap
|
page read and write
|
||
|
5C10000
|
trusted library allocation
|
page read and write
|
||
|
246C000
|
trusted library allocation
|
page read and write
|
||
|
F90000
|
heap
|
page read and write
|
||
|
439E000
|
direct allocation
|
page read and write
|
||
|
182F000
|
heap
|
page read and write
|
||
|
4183000
|
direct allocation
|
page read and write
|
||
|
1848000
|
heap
|
page read and write
|
||
|
1848000
|
heap
|
page read and write
|
||
|
230E000
|
stack
|
page read and write
|
||
|
373000
|
unkown
|
page execute and read and write
|
||
|
1905000
|
heap
|
page read and write
|
||
|
5BFE000
|
stack
|
page read and write
|
||
|
18CB000
|
heap
|
page read and write
|
||
|
236D000
|
trusted library allocation
|
page read and write
|
||
|
439E000
|
direct allocation
|
page read and write
|
||
|
3A8000
|
unkown
|
page execute and read and write
|
||
|
1848000
|
heap
|
page read and write
|
||
|
5CD0000
|
heap
|
page read and write
|
||
|
4A2E000
|
stack
|
page read and write
|
||
|
280000
|
unkown
|
page readonly
|
||
|
4A53000
|
heap
|
page read and write
|
||
|
18CB000
|
heap
|
page read and write
|
||
|
43E000
|
system
|
page execute and read and write
|
||
|
18F6000
|
heap
|
page read and write
|
There are 206 hidden memdumps, click here to show them.