IOC Report
R86BRY7DdC.exe

loading gif

Files

File Path
Type
Category
Malicious
R86BRY7DdC.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\R86BRY7DdC.exe.log
CSV text
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\Victim_SID[1].bd
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\Ebagelog[1].bd
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\R86BRY7DdC.exe
"C:\Users\user\Desktop\R86BRY7DdC.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
 malicious

URLs

Name
IP
Malicious
http://checkip.dyndns.org/
193.122.6.168
 malicious
https://investdirectinsurance.com/NO
unknown
https://investdirectinsurance.com/assuence/litesolidCha/Victim_SID.bdU
unknown
https://investdirectinsurance.com/assuence/litesolidCha/Victim_SID.bdN
unknown
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
https://investdirectinsurance.com/assuence/litesolidCha/Ebagelog.bd
172.67.189.102
http://checkip.dyndns.comh
unknown
http://checkip.dyndns.org/q
unknown
https://investdirectinsurance.com/assuence/litesolidCha/Victim_SID.bdK
unknown
http://reallyfreegeoip.org
unknown
https://investdirectinsurance.com/assuence/litesolidCha/Victim_SID.bd-
unknown
https://investdirectinsurance.com/assuence/litesolidCha/Victim_SID.bd
172.67.189.102
https://reallyfreegeoip.org
unknown
https://investdirectinsurance.com/zOO
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.com
unknown
https://investdirectinsurance.com/
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.96.3
https://investdirectinsurance.com/assuence/litesolidCha/Victim_SID.bdi/certs/Micr
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 11 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.96.3
 malicious
checkip.dyndns.com
193.122.6.168
 malicious
checkip.dyndns.org
unknown
 malicious
investdirectinsurance.com
172.67.189.102
fp2e7a.wpc.phicdn.net
192.229.221.95

IPs

IP
Domain
Country
Malicious
193.122.6.168
checkip.dyndns.com
United States
malicious
188.114.96.3
reallyfreegeoip.org
European Union
malicious
172.67.189.102
investdirectinsurance.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MSBuild_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
128E9000
trusted library allocation
page read and write
 malicious
356B000
trusted library allocation
page read and write
 malicious
33B1000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
31CF000
stack
page read and write
1680000
heap
page read and write
3320000
trusted library allocation
page read and write
6F20000
trusted library allocation
page execute and read and write
14F4000
heap
page read and write
443E000
trusted library allocation
page read and write
A90000
heap
page read and write
3050000
trusted library allocation
page read and write
7A0000
heap
page read and write
6D7E000
stack
page read and write
6D3E000
stack
page read and write
ABF000
heap
page read and write
1478000
heap
page read and write
3034000
trusted library allocation
page read and write
4417000
trusted library allocation
page read and write
A5C000
heap
page read and write
CB0000
heap
page read and write
3033000
trusted library allocation
page execute and read and write
5BD0000
heap
page execute and read and write
4447000
trusted library allocation
page read and write
C60000
heap
page execute and read and write
6A3D000
heap
page read and write
7FFD9B75D000
trusted library allocation
page execute and read and write
7FFD9B77B000
trusted library allocation
page execute and read and write
3508000
trusted library allocation
page read and write
5BA0000
trusted library allocation
page execute and read and write
348F000
trusted library allocation
page read and write
1B38E000
stack
page read and write
7FFD9B752000
trusted library allocation
page read and write
1B28B000
stack
page read and write
1519000
heap
page read and write
3056000
trusted library allocation
page execute and read and write
3330000
trusted library allocation
page read and write
54AE000
stack
page read and write
3080000
trusted library allocation
page read and write
1B790000
heap
page read and write
3519000
trusted library allocation
page read and write
363D000
trusted library allocation
page read and write
32EB000
trusted library allocation
page read and write
34B6000
trusted library allocation
page read and write
7FFD9B750000
trusted library allocation
page read and write
5E8000
unkown
page readonly
6BBE000
stack
page read and write
3462000
trusted library allocation
page read and write
FE7000
stack
page read and write
1B48E000
stack
page read and write
790000
heap
page read and write
32C0000
trusted library allocation
page execute and read and write
5BB0000
trusted library allocation
page read and write
5F30000
trusted library allocation
page read and write
C80000
heap
page read and write
35EB000
trusted library allocation
page read and write
6A2E000
heap
page read and write
B24000
heap
page read and write
7FFD9B900000
trusted library allocation
page read and write
3067000
trusted library allocation
page execute and read and write
5F40000
trusted library allocation
page read and write
5986000
trusted library allocation
page read and write
B3F000
heap
page read and write
1355000
heap
page read and write
7FFD9B76D000
trusted library allocation
page execute and read and write
5990000
heap
page read and write
3350000
trusted library allocation
page read and write
350C000
trusted library allocation
page read and write
34AE000
trusted library allocation
page read and write
597E000
trusted library allocation
page read and write
5B9E000
stack
page read and write
7FFD9B770000
trusted library allocation
page read and write
306B000
trusted library allocation
page execute and read and write
1B78E000
stack
page read and write
32FE000
trusted library allocation
page read and write
1350000
heap
page read and write
DBE000
stack
page read and write
7FFD9B754000
trusted library allocation
page read and write
7C0000
heap
page read and write
6A00000
heap
page read and write
A7C000
heap
page read and write
14A8000
heap
page read and write
35F5000
trusted library allocation
page read and write
34FB000
trusted library allocation
page read and write
AF1000
heap
page read and write
6E7F000
stack
page read and write
2822000
trusted library allocation
page read and write
3562000
trusted library allocation
page read and write
12803000
trusted library allocation
page read and write
1B68E000
stack
page read and write
68FE000
stack
page read and write
139E000
stack
page read and write
3637000
trusted library allocation
page read and write
3306000
trusted library allocation
page read and write
752000
stack
page read and write
27FE000
stack
page read and write
304D000
trusted library allocation
page execute and read and write
32D0000
trusted library allocation
page read and write
4431000
trusted library allocation
page read and write
32E0000
trusted library allocation
page read and write
35FE000
trusted library allocation
page read and write
3062000
trusted library allocation
page read and write
A84000
heap
page read and write
1BA8E000
stack
page read and write
2801000
trusted library allocation
page read and write
5993000
heap
page read and write
A56000
heap
page read and write
330D000
trusted library allocation
page read and write
6E80000
trusted library allocation
page read and write
3030000
trusted library allocation
page read and write
59A0000
heap
page read and write
3526000
trusted library allocation
page read and write
34F3000
trusted library allocation
page read and write
346B000
trusted library allocation
page read and write
305A000
trusted library allocation
page execute and read and write
A92000
heap
page read and write
1B98F000
stack
page read and write
34F7000
trusted library allocation
page read and write
7FFD9B760000
trusted library allocation
page read and write
6CFE000
stack
page read and write
5988000
trusted library allocation
page read and write
5880000
trusted library allocation
page execute and read and write
3052000
trusted library allocation
page read and write
3210000
heap
page read and write
13DE000
stack
page read and write
32F2000
trusted library allocation
page read and write
1470000
heap
page read and write
7FFD9B8F7000
trusted library allocation
page read and write
1B7C6000
heap
page read and write
345A000
trusted library allocation
page read and write
3603000
trusted library allocation
page read and write
7FF4BF6D0000
trusted library allocation
page execute and read and write
5F5000
unkown
page readonly
1250000
heap
page read and write
6CBE000
stack
page read and write
69FF000
stack
page read and write
35E5000
trusted library allocation
page read and write
43B1000
trusted library allocation
page read and write
3065000
trusted library allocation
page execute and read and write
5F20000
trusted library allocation
page execute and read and write
1B0E0000
trusted library section
page read and write
1553000
heap
page read and write
30CE000
stack
page read and write
CB5000
heap
page read and write
6B7E000
stack
page read and write
1670000
trusted library allocation
page read and write
7FFD9B77D000
trusted library allocation
page execute and read and write
32FA000
trusted library allocation
page read and write
35E0000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
26F0000
heap
page read and write
C85000
heap
page read and write
443B000
trusted library allocation
page read and write
7FFD9B836000
trusted library allocation
page execute and read and write
EEA000
stack
page read and write
3301000
trusted library allocation
page read and write
12808000
trusted library allocation
page read and write
3632000
trusted library allocation
page read and write
5BB3000
trusted library allocation
page read and write
1410000
heap
page read and write
12801000
trusted library allocation
page read and write
3040000
trusted library allocation
page read and write
5BBF000
trusted library allocation
page read and write
5D0000
unkown
page readonly
12805000
trusted library allocation
page read and write
7FFD9B800000
trusted library allocation
page read and write
A30000
trusted library allocation
page read and write
13E0000
heap
page read and write
362B000
trusted library allocation
page read and write
7FFD9B810000
trusted library allocation
page execute and read and write
3607000
trusted library allocation
page read and write
178E000
stack
page read and write
320E000
stack
page read and write
AC5000
heap
page read and write
EBE000
stack
page read and write
34A5000
trusted library allocation
page read and write
34B2000
trusted library allocation
page read and write
33A0000
heap
page execute and read and write
7FFD9B7AC000
trusted library allocation
page execute and read and write
34BA000
trusted library allocation
page read and write
6EB0000
heap
page read and write
1AD8D000
stack
page read and write
1330000
heap
page read and write
7FFD9B870000
trusted library allocation
page execute and read and write
32EE000
trusted library allocation
page read and write
1B58E000
stack
page read and write
34FF000
trusted library allocation
page read and write
7FFD9B8F0000
trusted library allocation
page read and write
7E0000
heap
page read and write
6B3D000
stack
page read and write
B02000
heap
page read and write
7400000
heap
page read and write
43D9000
trusted library allocation
page read and write
355D000
trusted library allocation
page read and write
5D0000
unkown
page readonly
582D000
stack
page read and write
5D2000
unkown
page readonly
5970000
trusted library allocation
page read and write
166E000
stack
page read and write
3060000
trusted library allocation
page read and write
3477000
trusted library allocation
page read and write
5BC0000
trusted library allocation
page execute and read and write
3474000
trusted library allocation
page read and write
5BBA000
trusted library allocation
page read and write
598B000
trusted library allocation
page read and write
5980000
trusted library allocation
page read and write
A50000
heap
page read and write
5870000
trusted library allocation
page read and write
1B180000
heap
page read and write
303D000
trusted library allocation
page execute and read and write
3504000
trusted library allocation
page read and write
A7A000
heap
page read and write
C20000
trusted library allocation
page read and write
B45000
heap
page read and write
7FFD9B764000
trusted library allocation
page read and write
There are 205 hidden memdumps, click here to show them.