IOC Report
ynhHNexysa.exe

loading gif

Files

File Path
Type
Category
Malicious
ynhHNexysa.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ynhHNexysa.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\ynhHNexysa.exe
"C:\Users\user\Desktop\ynhHNexysa.exe"
 malicious
C:\Users\user\Desktop\ynhHNexysa.exe
"C:\Users\user\Desktop\ynhHNexysa.exe"
 malicious
C:\Users\user\Desktop\ynhHNexysa.exe
"C:\Users\user\Desktop\ynhHNexysa.exe"
 malicious
C:\Users\user\Desktop\ynhHNexysa.exe
"C:\Users\user\Desktop\ynhHNexysa.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
172.67.74.152
http://smtp.jlahuachem.com
unknown
https://api.ipify.org
unknown
http://tempuri.org/dxsss.xsd
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://us2.smtp.mailhostbox.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Domains

Name
IP
Malicious
smtp.jlahuachem.com
unknown
 malicious
us2.smtp.mailhostbox.com
208.91.199.225
api.ipify.org
172.67.74.152

IPs

IP
Domain
Country
Malicious
208.91.198.143
unknown
United States
208.91.199.225
us2.smtp.mailhostbox.com
United States
208.91.199.223
unknown
United States
208.91.199.224
unknown
United States
172.67.74.152
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ynhHNexysa_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ynhHNexysa_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ynhHNexysa_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ynhHNexysa_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ynhHNexysa_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ynhHNexysa_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ynhHNexysa_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ynhHNexysa_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ynhHNexysa_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ynhHNexysa_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ynhHNexysa_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ynhHNexysa_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ynhHNexysa_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\ynhHNexysa_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2AB5000
trusted library allocation
page read and write
 malicious
2A91000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
3FA9000
trusted library allocation
page read and write
 malicious
4024000
trusted library allocation
page read and write
 malicious
1620000
trusted library allocation
page execute and read and write
2F40000
heap
page read and write
732E000
stack
page read and write
29EA000
trusted library allocation
page read and write
5AB0000
heap
page read and write
71F0000
heap
page read and write
75F0000
trusted library allocation
page read and write
28BC000
stack
page read and write
29DE000
trusted library allocation
page read and write
DE5000
heap
page read and write
D8A000
stack
page read and write
5680000
heap
page read and write
54E0000
trusted library allocation
page read and write
2A8D000
trusted library allocation
page read and write
D94000
heap
page read and write
5630000
trusted library allocation
page execute and read and write
CB0000
heap
page read and write
2F60000
trusted library allocation
page read and write
2F70000
heap
page read and write
B20000
heap
page read and write
D10000
trusted library allocation
page read and write
62D0000
heap
page read and write
3AA7000
trusted library allocation
page read and write
15C3000
trusted library allocation
page execute and read and write
5670000
trusted library allocation
page read and write
D04000
trusted library allocation
page read and write
7A9000
stack
page read and write
29E2000
trusted library allocation
page read and write
28C0000
heap
page execute and read and write
66DD000
stack
page read and write
F97000
heap
page read and write
54F5000
trusted library allocation
page read and write
679E000
stack
page read and write
2ACF000
trusted library allocation
page read and write
F3B000
trusted library allocation
page execute and read and write
6364000
heap
page read and write
3A69000
trusted library allocation
page read and write
EBE000
stack
page read and write
4F30000
heap
page read and write
54C6000
trusted library allocation
page read and write
A4DD000
stack
page read and write
5580000
trusted library allocation
page read and write
54D2000
trusted library allocation
page read and write
C50000
unkown
page readonly
F37000
trusted library allocation
page execute and read and write
2A05000
trusted library allocation
page read and write
5A80000
heap
page read and write
2E3E000
stack
page read and write
5570000
heap
page read and write
A81E000
stack
page read and write
75FB000
trusted library allocation
page read and write
D03000
trusted library allocation
page execute and read and write
15F7000
trusted library allocation
page execute and read and write
287E000
stack
page read and write
604E000
stack
page read and write
7440000
heap
page read and write
A5DD000
stack
page read and write
2A7F000
trusted library allocation
page read and write
5640000
trusted library allocation
page read and write
50E3000
heap
page read and write
B45000
heap
page read and write
C20000
trusted library allocation
page execute and read and write
7F350000
trusted library allocation
page execute and read and write
5A20000
trusted library allocation
page execute and read and write
6510000
heap
page read and write
C30000
trusted library allocation
page read and write
10F7000
stack
page read and write
15FB000
trusted library allocation
page execute and read and write
128A000
heap
page read and write
2A41000
trusted library allocation
page read and write
158E000
stack
page read and write
D5A000
heap
page read and write
3F81000
trusted library allocation
page read and write
2A02000
trusted library allocation
page read and write
54CD000
trusted library allocation
page read and write
D26000
trusted library allocation
page execute and read and write
567E000
stack
page read and write
15E6000
trusted library allocation
page execute and read and write
1340000
heap
page read and write
D30000
heap
page read and write
DB9000
heap
page read and write
15F0000
trusted library allocation
page read and write
15CD000
trusted library allocation
page execute and read and write
6520000
trusted library allocation
page read and write
A25E000
stack
page read and write
5A75000
heap
page read and write
532C000
stack
page read and write
1234000
heap
page read and write
6680000
trusted library allocation
page read and write
6700000
trusted library allocation
page execute and read and write
5030000
heap
page execute and read and write
75E0000
trusted library allocation
page read and write
54A0000
trusted library allocation
page read and write
1640000
trusted library allocation
page read and write
54BE000
trusted library allocation
page read and write
F32000
trusted library allocation
page read and write
D67000
heap
page read and write
A39E000
stack
page read and write
7FDB0000
trusted library allocation
page execute and read and write
C50000
trusted library allocation
page read and write
148E000
stack
page read and write
2C52000
trusted library allocation
page read and write
2C46000
trusted library allocation
page read and write
15F2000
trusted library allocation
page read and write
15C0000
trusted library allocation
page read and write
5582000
trusted library allocation
page read and write
54A4000
trusted library allocation
page read and write
8DCE000
stack
page read and write
1227000
heap
page read and write
A85E000
stack
page read and write
56CB000
stack
page read and write
78F2000
trusted library allocation
page read and write
2A14000
trusted library allocation
page read and write
CF7000
heap
page read and write
29DB000
trusted library allocation
page read and write
29FD000
trusted library allocation
page read and write
D20000
trusted library allocation
page read and write
56D0000
trusted library section
page readonly
C60000
trusted library allocation
page read and write
5A30000
trusted library allocation
page read and write
F90000
heap
page read and write
4BDE000
stack
page read and write
1630000
heap
page execute and read and write
6529000
trusted library allocation
page read and write
650E000
stack
page read and write
7462000
heap
page read and write
3016000
trusted library allocation
page read and write
6690000
trusted library allocation
page read and write
7600000
trusted library allocation
page execute and read and write
542E000
stack
page read and write
54C1000
trusted library allocation
page read and write
15E2000
trusted library allocation
page read and write
2C48000
trusted library allocation
page read and write
A49E000
stack
page read and write
11FA000
heap
page read and write
144E000
stack
page read and write
5C30000
trusted library allocation
page read and write
B40000
heap
page read and write
D65000
heap
page read and write
3BD5000
trusted library allocation
page read and write
2A76000
trusted library allocation
page read and write
B10000
heap
page read and write
C58000
trusted library allocation
page read and write
1224000
heap
page read and write
1657000
heap
page read and write
D0D000
trusted library allocation
page execute and read and write
DB3000
heap
page read and write
3060000
trusted library allocation
page read and write
CE0000
trusted library allocation
page read and write
4FFE000
stack
page read and write
D38000
heap
page read and write
1231000
heap
page read and write
109E000
stack
page read and write
2A30000
heap
page read and write
F70000
trusted library allocation
page read and write
2AC4000
trusted library allocation
page read and write
F60000
trusted library allocation
page execute and read and write
29F6000
trusted library allocation
page read and write
15C4000
trusted library allocation
page read and write
12B6000
heap
page read and write
6697000
trusted library allocation
page read and write
62FA000
heap
page read and write
5870000
heap
page read and write
5520000
trusted library allocation
page read and write
2C0A000
trusted library allocation
page read and write
11E0000
heap
page read and write
D00000
trusted library allocation
page read and write
A71E000
stack
page read and write
54AB000
trusted library allocation
page read and write
742E000
stack
page read and write
29D6000
trusted library allocation
page read and write
11F0000
heap
page read and write
E60000
heap
page read and write
7560000
trusted library section
page read and write
29CF000
stack
page read and write
F50000
trusted library allocation
page read and write
E40000
trusted library allocation
page execute and read and write
D2A000
trusted library allocation
page execute and read and write
515C000
stack
page read and write
5A90000
heap
page read and write
640E000
stack
page read and write
A35E000
stack
page read and write
C40000
trusted library allocation
page execute and read and write
50DE000
stack
page read and write
2C17000
trusted library allocation
page read and write
F35000
trusted library allocation
page execute and read and write
507C000
stack
page read and write
1610000
trusted library allocation
page read and write
2A20000
trusted library allocation
page read and write
D4E000
heap
page read and write
656E000
stack
page read and write
F80000
trusted library allocation
page read and write
C70000
trusted library allocation
page read and write
C52000
unkown
page readonly
5860000
heap
page read and write
CF0000
heap
page read and write
415E000
trusted library allocation
page read and write
54F0000
trusted library allocation
page read and write
D1D000
trusted library allocation
page execute and read and write
7430000
heap
page read and write
56E0000
heap
page read and write
3F89000
trusted library allocation
page read and write
2C39000
trusted library allocation
page read and write
29D0000
trusted library allocation
page read and write
132E000
stack
page read and write
1100000
heap
page read and write
5C20000
trusted library section
page read and write
3A41000
trusted library allocation
page read and write
2FC5000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
5BF0000
trusted library allocation
page read and write
15DD000
trusted library allocation
page execute and read and write
668D000
trusted library allocation
page read and write
5540000
heap
page execute and read and write
50E0000
heap
page read and write
DE0000
heap
page read and write
505B000
stack
page read and write
15E0000
trusted library allocation
page read and write
666F000
stack
page read and write
2A10000
trusted library allocation
page read and write
A95E000
stack
page read and write
6384000
heap
page read and write
4FBE000
stack
page read and write
5A60000
trusted library allocation
page execute and read and write
5A1E000
stack
page read and write
E30000
heap
page read and write
DCC000
heap
page read and write
6320000
heap
page read and write
2F81000
trusted library allocation
page read and write
2F3F000
stack
page read and write
29F1000
trusted library allocation
page read and write
4A48000
trusted library allocation
page read and write
15D0000
trusted library allocation
page read and write
1650000
heap
page read and write
D22000
trusted library allocation
page read and write
A21F000
stack
page read and write
DDE000
heap
page read and write
15EA000
trusted library allocation
page execute and read and write
15D3000
trusted library allocation
page read and write
5683000
heap
page read and write
29EE000
trusted library allocation
page read and write
5500000
trusted library allocation
page read and write
5C10000
trusted library section
page read and write
A5E0000
heap
page read and write
5A70000
heap
page read and write
7627000
trusted library allocation
page read and write
66E0000
heap
page read and write
11FE000
heap
page read and write
AF9000
stack
page read and write
15B0000
trusted library allocation
page read and write
There are 245 hidden memdumps, click here to show them.