Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Swift Copy.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\aut5F23.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut5F53.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\ghauts
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\nouses
|
ASCII text, with very long lines (28674), with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Swift Copy.exe
|
"C:\Users\user\Desktop\Swift Copy.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\Swift Copy.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://api.ipify.org/
|
172.67.74.152
|
||
|
http://mail.mahesh-ent.com
|
unknown
|
||
|
https://api.ipify.org
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
https://api.ipify.org/t
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
mail.mahesh-ent.com
|
148.66.136.151
|
|
|
|
api.ipify.org
|
172.67.74.152
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
148.66.136.151
|
mail.mahesh-ent.com
|
Singapore
|
|
|
|
172.67.74.152
|
api.ipify.org
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
EE0000
|
direct allocation
|
page read and write
|
|
|
|
32E1000
|
trusted library allocation
|
page read and write
|
|
|
|
402000
|
system
|
page execute and read and write
|
|
|
|
3D29000
|
direct allocation
|
page read and write
|
||
|
16AD000
|
trusted library allocation
|
page execute and read and write
|
||
|
325E000
|
trusted library allocation
|
page read and write
|
||
|
5AE0000
|
heap
|
page read and write
|
||
|
3D2D000
|
direct allocation
|
page read and write
|
||
|
162C000
|
stack
|
page read and write
|
||
|
31A8000
|
trusted library allocation
|
page read and write
|
||
|
58AE000
|
stack
|
page read and write
|
||
|
5760000
|
heap
|
page read and write
|
||
|
16CA000
|
trusted library allocation
|
page execute and read and write
|
||
|
3626000
|
trusted library allocation
|
page read and write
|
||
|
A7D000
|
stack
|
page read and write
|
||
|
35FB000
|
trusted library allocation
|
page read and write
|
||
|
9EF000
|
stack
|
page read and write
|
||
|
F9F000
|
heap
|
page read and write
|
||
|
3B83000
|
direct allocation
|
page read and write
|
||
|
3A60000
|
direct allocation
|
page read and write
|
||
|
6529000
|
heap
|
page read and write
|
||
|
7F07000
|
heap
|
page read and write
|
||
|
6A79000
|
trusted library allocation
|
page read and write
|
||
|
9FF000
|
stack
|
page read and write
|
||
|
2FFE000
|
stack
|
page read and write
|
||
|
731C000
|
stack
|
page read and write
|
||
|
3A60000
|
direct allocation
|
page read and write
|
||
|
3D2D000
|
direct allocation
|
page read and write
|
||
|
3757000
|
trusted library allocation
|
page read and write
|
||
|
F38000
|
heap
|
page read and write
|
||
|
F6E000
|
heap
|
page read and write
|
||
|
6CEE000
|
stack
|
page read and write
|
||
|
3B83000
|
direct allocation
|
page read and write
|
||
|
E57000
|
unkown
|
page readonly
|
||
|
324E000
|
trusted library allocation
|
page read and write
|
||
|
665E000
|
heap
|
page read and write
|
||
|
449A000
|
trusted library allocation
|
page read and write
|
||
|
656C000
|
stack
|
page read and write
|
||
|
17E0000
|
trusted library allocation
|
page read and write
|
||
|
42B9000
|
trusted library allocation
|
page read and write
|
||
|
E3C000
|
unkown
|
page read and write
|
||
|
3050000
|
trusted library allocation
|
page read and write
|
||
|
112F000
|
heap
|
page read and write
|
||
|
119A000
|
heap
|
page read and write
|
||
|
6688000
|
heap
|
page read and write
|
||
|
573C000
|
stack
|
page read and write
|
||
|
3D29000
|
direct allocation
|
page read and write
|
||
|
7350000
|
heap
|
page read and write
|
||
|
6BE0000
|
trusted library allocation
|
page read and write
|
||
|
E32000
|
unkown
|
page readonly
|
||
|
1490000
|
heap
|
page read and write
|
||
|
443A000
|
trusted library allocation
|
page read and write
|
||
|
E57000
|
unkown
|
page readonly
|
||
|
111B000
|
heap
|
page read and write
|
||
|
319E000
|
stack
|
page read and write
|
||
|
3D9E000
|
direct allocation
|
page read and write
|
||
|
17EB000
|
trusted library allocation
|
page execute and read and write
|
||
|
439A000
|
trusted library allocation
|
page read and write
|
||
|
6D2C000
|
stack
|
page read and write
|
||
|
E40000
|
unkown
|
page write copy
|
||
|
682D000
|
stack
|
page read and write
|
||
|
439C000
|
trusted library allocation
|
page read and write
|
||
|
3280000
|
heap
|
page execute and read and write
|
||
|
1B2E000
|
stack
|
page read and write
|
||
|
3583000
|
trusted library allocation
|
page read and write
|
||
|
A80000
|
heap
|
page read and write
|
||
|
6A6E000
|
stack
|
page read and write
|
||
|
1058000
|
heap
|
page read and write
|
||
|
119A000
|
heap
|
page read and write
|
||
|
32DD000
|
trusted library allocation
|
page read and write
|
||
|
9DB000
|
stack
|
page read and write
|
||
|
16A0000
|
trusted library allocation
|
page read and write
|
||
|
F65000
|
heap
|
page read and write
|
||
|
43FA000
|
trusted library allocation
|
page read and write
|
||
|
3D9E000
|
direct allocation
|
page read and write
|
||
|
56D0000
|
trusted library allocation
|
page read and write
|
||
|
9BF000
|
stack
|
page read and write
|
||
|
16B0000
|
trusted library allocation
|
page read and write
|
||
|
E0C000
|
unkown
|
page readonly
|
||
|
ED0000
|
direct allocation
|
page execute and read and write
|
||
|
FE8000
|
heap
|
page read and write
|
||
|
43E000
|
system
|
page execute and read and write
|
||
|
3C00000
|
direct allocation
|
page read and write
|
||
|
815C000
|
stack
|
page read and write
|
||
|
32C6000
|
trusted library allocation
|
page read and write
|
||
|
1185000
|
heap
|
page read and write
|
||
|
8260000
|
heap
|
page read and write
|
||
|
335A000
|
trusted library allocation
|
page read and write
|
||
|
16D0000
|
heap
|
page read and write
|
||
|
352D000
|
trusted library allocation
|
page read and write
|
||
|
166C000
|
stack
|
page read and write
|
||
|
FC7000
|
heap
|
page read and write
|
||
|
5750000
|
heap
|
page read and write
|
||
|
FB9000
|
heap
|
page read and write
|
||
|
32CF000
|
trusted library allocation
|
page read and write
|
||
|
4291000
|
trusted library allocation
|
page read and write
|
||
|
16A3000
|
trusted library allocation
|
page execute and read and write
|
||
|
F7A000
|
stack
|
page read and write
|
||
|
E44000
|
unkown
|
page readonly
|
||
|
17E5000
|
trusted library allocation
|
page execute and read and write
|
||
|
696E000
|
stack
|
page read and write
|
||
|
6C50000
|
trusted library allocation
|
page execute and read and write
|
||
|
E32000
|
unkown
|
page readonly
|
||
|
F6E000
|
heap
|
page read and write
|
||
|
16C6000
|
trusted library allocation
|
page execute and read and write
|
||
|
143F000
|
heap
|
page read and write
|
||
|
9CF000
|
stack
|
page read and write
|
||
|
ACE000
|
stack
|
page read and write
|
||
|
3080000
|
trusted library allocation
|
page read and write
|
||
|
3291000
|
trusted library allocation
|
page read and write
|
||
|
3D9E000
|
direct allocation
|
page read and write
|
||
|
3749000
|
trusted library allocation
|
page read and write
|
||
|
34AB000
|
trusted library allocation
|
page read and write
|
||
|
FA8000
|
heap
|
page read and write
|
||
|
58D0000
|
heap
|
page execute and read and write
|
||
|
43BA000
|
trusted library allocation
|
page read and write
|
||
|
17E7000
|
trusted library allocation
|
page execute and read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
357F000
|
trusted library allocation
|
page read and write
|
||
|
D71000
|
unkown
|
page execute read
|
||
|
3714000
|
heap
|
page read and write
|
||
|
7E60000
|
heap
|
page read and write
|
||
|
59DC000
|
stack
|
page read and write
|
||
|
3D9E000
|
direct allocation
|
page read and write
|
||
|
6C40000
|
trusted library allocation
|
page read and write
|
||
|
A3E000
|
stack
|
page read and write
|
||
|
E44000
|
unkown
|
page readonly
|
||
|
6F2E000
|
stack
|
page read and write
|
||
|
3040000
|
trusted library allocation
|
page execute and read and write
|
||
|
6BD0000
|
trusted library allocation
|
page read and write
|
||
|
2FB0000
|
trusted library allocation
|
page read and write
|
||
|
1090000
|
heap
|
page read and write
|
||
|
F55000
|
heap
|
page read and write
|
||
|
D60000
|
heap
|
page read and write
|
||
|
13FA000
|
heap
|
page read and write
|
||
|
42FA000
|
trusted library allocation
|
page read and write
|
||
|
D70000
|
unkown
|
page readonly
|
||
|
5CBB000
|
stack
|
page read and write
|
||
|
16C2000
|
trusted library allocation
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
441A000
|
trusted library allocation
|
page read and write
|
||
|
5CC0000
|
trusted library allocation
|
page read and write
|
||
|
3090000
|
heap
|
page read and write
|
||
|
16A4000
|
trusted library allocation
|
page read and write
|
||
|
6BBF000
|
stack
|
page read and write
|
||
|
E3C000
|
unkown
|
page write copy
|
||
|
6D40000
|
trusted library allocation
|
page read and write
|
||
|
14E5000
|
heap
|
page read and write
|
||
|
3D29000
|
direct allocation
|
page read and write
|
||
|
37BD000
|
trusted library allocation
|
page read and write
|
||
|
445A000
|
trusted library allocation
|
page read and write
|
||
|
6520000
|
heap
|
page read and write
|
||
|
7360000
|
trusted library allocation
|
page read and write
|
||
|
3C00000
|
direct allocation
|
page read and write
|
||
|
10E2000
|
heap
|
page read and write
|
||
|
1F2E000
|
stack
|
page read and write
|
||
|
FE7000
|
heap
|
page read and write
|
||
|
8270000
|
heap
|
page read and write
|
||
|
119A000
|
heap
|
page read and write
|
||
|
36C0000
|
trusted library allocation
|
page read and write
|
||
|
6C30000
|
trusted library allocation
|
page read and write
|
||
|
433A000
|
trusted library allocation
|
page read and write
|
||
|
6C2E000
|
stack
|
page read and write
|
||
|
BA0000
|
heap
|
page read and write
|
||
|
3B83000
|
direct allocation
|
page read and write
|
||
|
64EC000
|
stack
|
page read and write
|
||
|
AE0000
|
heap
|
page read and write
|
||
|
E55000
|
unkown
|
page readonly
|
||
|
3240000
|
trusted library allocation
|
page read and write
|
||
|
6F6E000
|
stack
|
page read and write
|
||
|
3D2D000
|
direct allocation
|
page read and write
|
||
|
431A000
|
trusted library allocation
|
page read and write
|
||
|
447A000
|
trusted library allocation
|
page read and write
|
||
|
1806000
|
heap
|
page read and write
|
||
|
3D29000
|
direct allocation
|
page read and write
|
||
|
538D000
|
stack
|
page read and write
|
||
|
E55000
|
unkown
|
page readonly
|
||
|
13D0000
|
heap
|
page read and write
|
||
|
3261000
|
trusted library allocation
|
page read and write
|
||
|
119C000
|
heap
|
page read and write
|
||
|
17E2000
|
trusted library allocation
|
page read and write
|
||
|
F69000
|
heap
|
page read and write
|
||
|
118B000
|
heap
|
page read and write
|
||
|
6696000
|
heap
|
page read and write
|
||
|
3D29000
|
direct allocation
|
page read and write
|
||
|
7F65000
|
heap
|
page read and write
|
||
|
56E0000
|
trusted library allocation
|
page read and write
|
||
|
14E0000
|
heap
|
page read and write
|
||
|
3710000
|
heap
|
page read and write
|
||
|
70D0000
|
trusted library allocation
|
page read and write
|
||
|
3252000
|
trusted library allocation
|
page read and write
|
||
|
65B0000
|
heap
|
page read and write
|
||
|
1465000
|
heap
|
page read and write
|
||
|
692E000
|
stack
|
page read and write
|
||
|
E47000
|
unkown
|
page readonly
|
||
|
E47000
|
unkown
|
page readonly
|
||
|
3A60000
|
direct allocation
|
page read and write
|
||
|
6BE7000
|
trusted library allocation
|
page read and write
|
||
|
2BA000
|
stack
|
page read and write
|
||
|
16BD000
|
trusted library allocation
|
page execute and read and write
|
||
|
64F0000
|
heap
|
page read and write
|
||
|
3D2D000
|
direct allocation
|
page read and write
|
||
|
3B83000
|
direct allocation
|
page read and write
|
||
|
6ABE000
|
stack
|
page read and write
|
||
|
7F480000
|
trusted library allocation
|
page execute and read and write
|
||
|
12F8000
|
stack
|
page read and write
|
||
|
3D9E000
|
direct allocation
|
page read and write
|
||
|
43DA000
|
trusted library allocation
|
page read and write
|
||
|
1496000
|
heap
|
page read and write
|
||
|
1189000
|
heap
|
page read and write
|
||
|
3710000
|
trusted library allocation
|
page read and write
|
||
|
5744000
|
heap
|
page read and write
|
||
|
D70000
|
unkown
|
page readonly
|
||
|
58C0000
|
heap
|
page read and write
|
||
|
FE7000
|
heap
|
page read and write
|
||
|
5CD0000
|
trusted library allocation
|
page read and write
|
||
|
16D7000
|
heap
|
page read and write
|
||
|
D71000
|
unkown
|
page execute read
|
||
|
7E70000
|
heap
|
page read and write
|
||
|
14A9000
|
heap
|
page read and write
|
||
|
437A000
|
trusted library allocation
|
page read and write
|
||
|
70E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
6D30000
|
trusted library allocation
|
page execute and read and write
|
||
|
152C000
|
stack
|
page read and write
|
||
|
3C00000
|
direct allocation
|
page read and write
|
||
|
64AD000
|
stack
|
page read and write
|
||
|
A25C000
|
stack
|
page read and write
|
||
|
1405000
|
heap
|
page read and write
|
||
|
3581000
|
trusted library allocation
|
page read and write
|
||
|
13D8000
|
heap
|
page read and write
|
||
|
6A70000
|
trusted library allocation
|
page read and write
|
||
|
17DD000
|
stack
|
page read and write
|
||
|
6C36000
|
trusted library allocation
|
page read and write
|
||
|
66A7000
|
heap
|
page read and write
|
||
|
3A60000
|
direct allocation
|
page read and write
|
||
|
1173000
|
heap
|
page read and write
|
||
|
7E74000
|
heap
|
page read and write
|
||
|
70F0000
|
heap
|
page read and write
|
||
|
3C00000
|
direct allocation
|
page read and write
|
||
|
6EEC000
|
stack
|
page read and write
|
||
|
1007000
|
heap
|
page read and write
|
||
|
5740000
|
heap
|
page read and write
|
||
|
3266000
|
trusted library allocation
|
page read and write
|
||
|
3A60000
|
direct allocation
|
page read and write
|
||
|
3D2D000
|
direct allocation
|
page read and write
|
||
|
5ADE000
|
stack
|
page read and write
|
||
|
303C000
|
stack
|
page read and write
|
||
|
11A4000
|
heap
|
page read and write
|
||
|
1169000
|
heap
|
page read and write
|
||
|
7E5C000
|
stack
|
page read and write
|
||
|
3394000
|
trusted library allocation
|
page read and write
|
||
|
172D000
|
stack
|
page read and write
|
||
|
7E99000
|
heap
|
page read and write
|
||
|
FC7000
|
heap
|
page read and write
|
||
|
324B000
|
trusted library allocation
|
page read and write
|
||
|
6679000
|
heap
|
page read and write
|
||
|
320000
|
heap
|
page read and write
|
||
|
326D000
|
trusted library allocation
|
page read and write
|
||
|
63AF000
|
stack
|
page read and write
|
||
|
FE0000
|
heap
|
page read and write
|
||
|
118B000
|
heap
|
page read and write
|
||
|
F30000
|
heap
|
page read and write
|
||
|
E0C000
|
unkown
|
page readonly
|
||
|
6BDD000
|
trusted library allocation
|
page read and write
|
||
|
16C0000
|
trusted library allocation
|
page read and write
|
||
|
1800000
|
heap
|
page read and write
|
||
|
3D29000
|
direct allocation
|
page read and write
|
||
|
1690000
|
trusted library allocation
|
page read and write
|
||
|
5C60000
|
trusted library allocation
|
page read and write
|
||
|
1408000
|
heap
|
page read and write
|
||
|
3D9E000
|
direct allocation
|
page read and write
|
||
|
3B83000
|
direct allocation
|
page read and write
|
||
|
3060000
|
heap
|
page read and write
|
||
|
35BE000
|
trusted library allocation
|
page read and write
|
||
|
36EC000
|
trusted library allocation
|
page read and write
|
||
|
435A000
|
trusted library allocation
|
page read and write
|
||
|
3C00000
|
direct allocation
|
page read and write
|
||
|
3B83000
|
direct allocation
|
page read and write
|
||
|
5C1E000
|
stack
|
page read and write
|
||
|
3A60000
|
direct allocation
|
page read and write
|
||
|
3D2D000
|
direct allocation
|
page read and write
|
||
|
3C00000
|
direct allocation
|
page read and write
|
||
|
149A000
|
heap
|
page read and write
|
There are 273 hidden memdumps, click here to show them.