IOC Report
New order.exe

loading gif

Files

File Path
Type
Category
Malicious
New order.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BjTxJte.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\alarmingness
data
dropped
C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
modified
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\New order.exe
"C:\Users\user\Desktop\New order.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\New order.exe"
 malicious
C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
malicious
C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.12.205
https://api.ipify.org
unknown
http://r10.o.lencr.org0#
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://mail.starmech.net
unknown
http://r10.i.lencr.org/0W
unknown

Domains

Name
IP
Malicious
mail.starmech.net
207.174.215.249
 malicious
api.ipify.org
104.26.12.205
15.164.165.52.in-addr.arpa
unknown

IPs

IP
Domain
Country
Malicious
207.174.215.249
mail.starmech.net
United States
malicious
104.26.12.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
BjTxJte
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
system
page execute and read and write
 malicious
2AF1000
trusted library allocation
page read and write
 malicious
3710000
direct allocation
page read and write
 malicious
2B24000
trusted library allocation
page read and write
 malicious
2B1C000
trusted library allocation
page read and write
 malicious
129D000
trusted library allocation
page execute and read and write
64CB000
trusted library allocation
page read and write
F68C000
stack
page read and write
830000
unkown
page readonly
3EE9000
heap
page read and write
2B1A000
trusted library allocation
page read and write
4FA1000
trusted library allocation
page read and write
DE8000
heap
page read and write
121E000
stack
page read and write
A14C000
stack
page read and write
A18C000
stack
page read and write
C30000
heap
page read and write
F90E000
stack
page read and write
2AA1000
trusted library allocation
page read and write
6D5C000
stack
page read and write
5084000
heap
page read and write
8AF000
stack
page read and write
6D80000
heap
page read and write
2C00000
heap
page execute and read and write
28DE000
stack
page read and write
10FF000
stack
page read and write
294E000
stack
page read and write
A8AE000
trusted library allocation
page read and write
A00E000
stack
page read and write
29E0000
heap
page read and write
F40000
heap
page read and write
F58E000
stack
page read and write
FE0000
heap
page read and write
2877000
trusted library allocation
page execute and read and write
4F8B000
trusted library allocation
page read and write
3E67000
heap
page read and write
89F000
stack
page read and write
2B2F000
trusted library allocation
page read and write
4583000
direct allocation
page read and write
3B24000
trusted library allocation
page read and write
5070000
trusted library allocation
page execute and read and write
78A2000
heap
page read and write
63B6000
trusted library allocation
page read and write
4460000
direct allocation
page read and write
5070000
heap
page read and write
4FB2000
trusted library allocation
page read and write
3818000
heap
page read and write
3D71000
trusted library allocation
page read and write
9DCC000
stack
page read and write
66AC000
unkown
page read and write
F77000
heap
page read and write
4729000
direct allocation
page read and write
4600000
direct allocation
page read and write
1060000
trusted library allocation
page read and write
D0A6000
trusted library allocation
page read and write
2866000
trusted library allocation
page execute and read and write
4583000
direct allocation
page read and write
FC4E000
stack
page read and write
E50000
heap
page read and write
2910000
heap
page execute and read and write
FAF000
stack
page read and write
793E000
heap
page read and write
3DF4000
heap
page read and write
CEE000
heap
page read and write
FC8E000
stack
page read and write
3F66000
heap
page read and write
4F8E000
trusted library allocation
page read and write
57FE000
stack
page read and write
29B0000
trusted library allocation
page execute and read and write
2BF0000
trusted library allocation
page read and write
2BCE000
stack
page read and write
490000
unkown
page read and write
E00E000
stack
page read and write
4583000
direct allocation
page read and write
BF0000
heap
page read and write
123E000
stack
page read and write
28CD000
trusted library allocation
page execute and read and write
15E000
stack
page read and write
D0AE000
trusted library allocation
page read and write
4AB000
unkown
page readonly
EA5000
heap
page read and write
6D90000
trusted library allocation
page read and write
37A0000
heap
page read and write
29C0000
trusted library allocation
page read and write
2AE5000
trusted library allocation
page read and write
A6F000
heap
page read and write
490000
unkown
page write copy
3EEA000
heap
page read and write
6C9C000
stack
page read and write
2A60000
trusted library allocation
page read and write
FD8E000
stack
page read and write
524C000
stack
page read and write
472D000
direct allocation
page read and write
3EEA000
heap
page read and write
67AC000
stack
page read and write
4460000
direct allocation
page read and write
4AB000
unkown
page readonly
3F30000
heap
page read and write
19E000
stack
page read and write
A3E000
stack
page read and write
111E000
stack
page read and write
128D000
trusted library allocation
page execute and read and write
479E000
direct allocation
page read and write
3F55000
heap
page read and write
67EE000
stack
page read and write
5E8C000
heap
page read and write
1284000
trusted library allocation
page read and write
3837000
heap
page read and write
5DE0000
heap
page read and write
29D0000
trusted library allocation
page read and write
547E000
stack
page read and write
EA0000
heap
page read and write
1294000
trusted library allocation
page read and write
A4E000
heap
page read and write
5810000
trusted library allocation
page read and write
3F30000
heap
page read and write
696C000
stack
page read and write
7D95000
heap
page read and write
3D51000
heap
page read and write
3EEA000
heap
page read and write
F70000
heap
page read and write
9601000
trusted library allocation
page read and write
5DE8000
heap
page read and write
560E000
stack
page read and write
4729000
direct allocation
page read and write
57BD000
stack
page read and write
4729000
direct allocation
page read and write
3EEA000
heap
page read and write
E10E000
stack
page read and write
9610000
trusted library allocation
page read and write
2BCF000
trusted library allocation
page read and write
582D000
trusted library allocation
page read and write
28A0000
trusted library allocation
page read and write
6CDE000
stack
page read and write
F7CE000
stack
page read and write
4729000
direct allocation
page read and write
B39000
stack
page read and write
361E000
stack
page read and write
95FC000
trusted library allocation
page read and write
3EEA000
heap
page read and write
1016000
heap
page read and write
3E8C000
heap
page read and write
362B000
heap
page read and write
125E000
stack
page read and write
4583000
direct allocation
page read and write
472D000
direct allocation
page read and write
100000
heap
page read and write
28B4000
trusted library allocation
page read and write
4729000
direct allocation
page read and write
4583000
direct allocation
page read and write
6367000
trusted library allocation
page read and write
611E000
stack
page read and write
2ADD000
trusted library allocation
page read and write
479E000
direct allocation
page read and write
3D56000
heap
page read and write
2BC8000
trusted library allocation
page read and write
4FA6000
trusted library allocation
page read and write
621E000
stack
page read and write
3F30000
heap
page read and write
479E000
direct allocation
page read and write
3C9F000
stack
page read and write
1050000
trusted library allocation
page execute and read and write
4FFC000
stack
page read and write
C18000
heap
page read and write
3AA1000
trusted library allocation
page read and write
287B000
trusted library allocation
page execute and read and write
C10000
heap
page read and write
2ED5000
heap
page read and write
2900000
trusted library allocation
page read and write
2890000
trusted library allocation
page read and write
505E000
stack
page read and write
790E000
heap
page read and write
7B8E000
stack
page read and write
3E57000
heap
page read and write
64AE000
stack
page read and write
567E000
stack
page read and write
DB0000
heap
page read and write
A7D000
heap
page read and write
E38000
heap
page read and write
1004000
heap
page read and write
4C3E000
stack
page read and write
1B0000
heap
page read and write
112CE000
stack
page read and write
D50000
heap
page read and write
9A000
stack
page read and write
69A0000
trusted library allocation
page execute and read and write
4460000
direct allocation
page read and write
3F6A000
heap
page read and write
C8E000
stack
page read and write
13BF000
stack
page read and write
FBB000
unkown
page read and write
3EEA000
heap
page read and write
4AA8000
trusted library allocation
page read and write
520E000
stack
page read and write
50DE000
stack
page read and write
C47000
heap
page read and write
544F000
stack
page read and write
511E000
stack
page read and write
2AD6000
trusted library allocation
page read and write
2B51000
trusted library allocation
page read and write
1A0000
heap
page read and write
7A8C000
stack
page read and write
515E000
stack
page read and write
63D0000
trusted library allocation
page execute and read and write
3D41000
heap
page read and write
2AEE000
stack
page read and write
B7D0000
trusted library allocation
page read and write
682E000
stack
page read and write
F2C000
stack
page read and write
9CA000
stack
page read and write
5DE2000
heap
page read and write
51CC000
stack
page read and write
A4A000
heap
page read and write
3F30000
heap
page read and write
A7D000
heap
page read and write
4A7000
unkown
page read and write
104A000
heap
page read and write
3F65000
heap
page execute and read and write
4F9E000
trusted library allocation
page read and write
54CE000
stack
page read and write
3EEA000
heap
page read and write
2A5C000
stack
page read and write
2844000
trusted library allocation
page read and write
FEE000
stack
page read and write
3F30000
heap
page read and write
FFF000
heap
page read and write
4600000
direct allocation
page read and write
3EA1000
heap
page read and write
3E60000
heap
page read and write
3D54000
heap
page read and write
55CF000
stack
page read and write
472D000
direct allocation
page read and write
479E000
direct allocation
page read and write
3CA0000
heap
page read and write
2EB0000
heap
page read and write
284D000
trusted library allocation
page execute and read and write
285D000
trusted library allocation
page execute and read and write
DCF000
heap
page read and write
3F30000
heap
page read and write
4729000
direct allocation
page read and write
482000
unkown
page readonly
1283000
trusted library allocation
page execute and read and write
2EA0000
heap
page read and write
3F30000
heap
page read and write
537C000
stack
page read and write
7C8C000
stack
page read and write
482000
unkown
page readonly
FB4E000
stack
page read and write
4600000
direct allocation
page read and write
577D000
stack
page read and write
8B4000
stack
page read and write
2D50000
trusted library allocation
page execute and read and write
686C000
stack
page read and write
898E000
stack
page read and write
4600000
direct allocation
page read and write
3EEA000
heap
page read and write
D55000
heap
page read and write
2860000
trusted library allocation
page read and write
7910000
heap
page read and write
77BB000
heap
page read and write
534E000
stack
page read and write
4FAD000
trusted library allocation
page read and write
479E000
direct allocation
page read and write
2E94000
trusted library allocation
page read and write
2D45000
trusted library allocation
page read and write
2C64000
trusted library allocation
page read and write
2A1E000
stack
page read and write
4460000
direct allocation
page read and write
A3CC000
stack
page read and write
3E58000
heap
page read and write
3B03000
trusted library allocation
page read and write
3EEA000
heap
page read and write
2872000
trusted library allocation
page read and write
4600000
direct allocation
page read and write
37A1000
heap
page read and write
5820000
trusted library allocation
page read and write
7D90000
heap
page read and write
28B3000
trusted library allocation
page execute and read and write
3E43000
heap
page read and write
5090000
heap
page read and write
1040000
heap
page read and write
D70000
heap
page read and write
4460000
direct allocation
page read and write
2990000
heap
page read and write
64C0000
trusted library allocation
page read and write
298C000
stack
page read and write
77F9000
heap
page read and write
2C2D000
trusted library allocation
page read and write
FAF000
stack
page read and write
5818000
trusted library allocation
page read and write
3D59000
heap
page read and write
3D96000
heap
page read and write
100A000
heap
page read and write
DD4000
heap
page read and write
3AC9000
trusted library allocation
page read and write
3EA1000
heap
page read and write
2EAF000
trusted library allocation
page read and write
3E58000
heap
page read and write
D0A9000
trusted library allocation
page read and write
DDB000
heap
page read and write
2D0E000
stack
page read and write
A40000
heap
page read and write
42A5000
heap
page read and write
2D71000
trusted library allocation
page read and write
3EEA000
heap
page read and write
FA10000
heap
page read and write
D50000
heap
page read and write
53CE000
stack
page read and write
C3A000
heap
page read and write
3D4A000
heap
page read and write
3EA0000
heap
page read and write
1290000
trusted library allocation
page read and write
9EC000
stack
page read and write
12B0000
heap
page read and write
4600000
direct allocation
page read and write
2850000
trusted library allocation
page read and write
28E7000
trusted library allocation
page execute and read and write
51C0000
heap
page execute and read and write
3EEA000
heap
page read and write
832000
unkown
page readonly
1A5000
heap
page read and write
400000
unkown
page readonly
4F0E000
stack
page read and write
4460000
direct allocation
page read and write
472D000
direct allocation
page read and write
2D60000
heap
page read and write
28F0000
trusted library allocation
page read and write
A8A7000
trusted library allocation
page read and write
2900000
trusted library allocation
page read and write
95FA000
trusted library allocation
page read and write
43E000
system
page execute and read and write
9EE000
stack
page read and write
4358000
heap
page read and write
286A000
trusted library allocation
page execute and read and write
C00000
heap
page read and write
6360000
trusted library allocation
page read and write
6D1E000
stack
page read and write
2A70000
trusted library allocation
page read and write
F54C000
stack
page read and write
2875000
trusted library allocation
page execute and read and write
2D4C000
stack
page read and write
2AED000
trusted library allocation
page read and write
63AC000
stack
page read and write
2C25000
trusted library allocation
page read and write
2D7D000
trusted library allocation
page read and write
3F30000
heap
page read and write
F78E000
stack
page read and write
3EEA000
heap
page read and write
D20000
trusted library allocation
page read and write
A28C000
stack
page read and write
69B0000
heap
page read and write
3F55000
heap
page read and write
E30000
heap
page read and write
111CE000
stack
page read and write
400000
unkown
page readonly
3F30000
heap
page read and write
2ECA000
trusted library allocation
page read and write
2B3A000
trusted library allocation
page read and write
D10000
trusted library allocation
page read and write
63C0000
trusted library allocation
page execute and read and write
28EB000
trusted library allocation
page execute and read and write
FD90000
trusted library allocation
page read and write
2B6B000
trusted library allocation
page execute and read and write
A8A9000
trusted library allocation
page read and write
666E000
stack
page read and write
2840000
trusted library allocation
page read and write
163F000
stack
page read and write
4CEE000
stack
page read and write
990000
heap
page read and write
BEC000
stack
page read and write
1D0000
heap
page read and write
FFB000
stack
page read and write
7FA50000
trusted library allocation
page execute and read and write
2ED0000
heap
page read and write
C40000
heap
page read and write
9F0E000
stack
page read and write
472D000
direct allocation
page read and write
2BD0000
trusted library allocation
page execute and read and write
52CE000
stack
page read and write
103C000
stack
page read and write
7D8C000
stack
page read and write
28E0000
trusted library allocation
page read and write
E16000
heap
page read and write
1270000
trusted library allocation
page read and write
C06000
heap
page read and write
3EFA000
heap
page read and write
4F92000
trusted library allocation
page read and write
2B44000
trusted library allocation
page read and write
83A000
unkown
page readonly
3B51000
trusted library allocation
page read and write
2B80000
trusted library allocation
page read and write
400000
system
page execute and read and write
C2E000
heap
page read and write
3F30000
heap
page read and write
6990000
trusted library allocation
page read and write
5480000
heap
page execute and read and write
2830000
trusted library allocation
page read and write
FB0000
heap
page read and write
3F66000
heap
page read and write
791C000
heap
page read and write
D40000
heap
page read and write
401000
unkown
page execute read
28C4000
trusted library allocation
page read and write
2E58000
trusted library allocation
page read and write
960B000
trusted library allocation
page read and write
CFA000
stack
page read and write
3EEA000
heap
page read and write
4F80000
trusted library allocation
page read and write
C95000
heap
page read and write
8CC000
stack
page read and write
5270000
heap
page execute and read and write
9ECC000
stack
page read and write
E9E000
stack
page read and write
2B60000
trusted library allocation
page read and write
BA0000
heap
page read and write
A3A000
stack
page read and write
3D5E000
heap
page read and write
472D000
direct allocation
page read and write
2E5C000
trusted library allocation
page read and write
110000
heap
page read and write
2AE9000
trusted library allocation
page read and write
2B67000
trusted library allocation
page execute and read and write
2870000
trusted library allocation
page read and write
A04C000
stack
page read and write
5080000
heap
page read and write
78FF000
heap
page read and write
625E000
stack
page read and write
5E00000
heap
page read and write
F8CE000
stack
page read and write
2C2B000
trusted library allocation
page read and write
2EA4000
heap
page read and write
3DD0000
heap
page read and write
401000
unkown
page execute read
DB8000
heap
page read and write
64B0000
trusted library allocation
page read and write
63B0000
trusted library allocation
page read and write
A72000
heap
page read and write
2DE9000
trusted library allocation
page read and write
FE8000
heap
page read and write
635F000
stack
page read and write
2843000
trusted library allocation
page execute and read and write
54CE000
stack
page read and write
2B18000
trusted library allocation
page read and write
2BE0000
trusted library allocation
page read and write
2B40000
heap
page execute and read and write
9606000
trusted library allocation
page read and write
557C000
stack
page read and write
2A90000
heap
page read and write
7790000
heap
page read and write
C90000
heap
page read and write
2862000
trusted library allocation
page read and write
646D000
stack
page read and write
28C0000
trusted library allocation
page read and write
7DA0000
heap
page read and write
C49000
heap
page read and write
28BD000
trusted library allocation
page execute and read and write
479E000
direct allocation
page read and write
FF0000
heap
page read and write
A2CC000
stack
page read and write
570E000
stack
page read and write
FA0E000
stack
page read and write
3F30000
heap
page read and write
E2C000
heap
page read and write
4583000
direct allocation
page read and write
28E0000
trusted library allocation
page execute and read and write
There are 455 hidden memdumps, click here to show them.