IOC Report
QUOTATIONS#08671.exe

loading gif

Files

File Path
Type
Category
Malicious
QUOTATIONS#08671.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\newapp.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\spiketop
data
dropped
C:\Users\user\AppData\Roaming\newapp\newapp.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
modified
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\QUOTATIONS#08671.exe
"C:\Users\user\Desktop\QUOTATIONS#08671.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\QUOTATIONS#08671.exe"
 malicious
C:\Users\user\AppData\Roaming\newapp\newapp.exe
"C:\Users\user\AppData\Roaming\newapp\newapp.exe"
malicious
C:\Users\user\AppData\Roaming\newapp\newapp.exe
"C:\Users\user\AppData\Roaming\newapp\newapp.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.12.205
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ftp.ercolina-usa.com
unknown
http://ercolina-usa.com
unknown

Domains

Name
IP
Malicious
ercolina-usa.com
192.254.225.136
 malicious
ftp.ercolina-usa.com
unknown
 malicious
api.ipify.org
104.26.12.205

IPs

IP
Domain
Country
Malicious
192.254.225.136
ercolina-usa.com
United States
malicious
104.26.12.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
newapp
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
system
page execute and read and write
 malicious
B70000
direct allocation
page read and write
 malicious
2BCC000
trusted library allocation
page read and write
 malicious
2BA1000
trusted library allocation
page read and write
 malicious
C18000
heap
page read and write
3150000
direct allocation
page read and write
DBE000
stack
page read and write
11F7000
trusted library allocation
page execute and read and write
7F8000
stack
page read and write
1090000
trusted library allocation
page read and write
65AE000
stack
page read and write
555D000
stack
page read and write
3FDB000
heap
page read and write
2BC8000
trusted library allocation
page read and write
2AD0000
trusted library allocation
page read and write
11C3000
trusted library allocation
page execute and read and write
D40000
trusted library allocation
page read and write
4021000
heap
page read and write
D57000
trusted library allocation
page execute and read and write
DD0000
heap
page read and write
BAE000
stack
page read and write
1080000
trusted library allocation
page read and write
103F000
stack
page read and write
1820000
heap
page read and write
5C84000
heap
page read and write
5FBE000
stack
page read and write
FDE000
stack
page read and write
2B40000
heap
page execute and read and write
4FCC000
stack
page read and write
1080000
heap
page read and write
2ADB000
trusted library allocation
page read and write
66EC000
stack
page read and write
52AE000
stack
page read and write
6380000
trusted library allocation
page read and write
E8A000
unkown
page readonly
3FDB000
heap
page read and write
3191000
trusted library allocation
page read and write
6220000
trusted library allocation
page read and write
D3D000
trusted library allocation
page execute and read and write
12C0000
heap
page read and write
479E000
direct allocation
page read and write
107E000
stack
page read and write
3FDB000
heap
page read and write
6370000
trusted library allocation
page execute and read and write
4021000
heap
page read and write
3340000
heap
page read and write
3FDB000
heap
page read and write
2B51000
trusted library allocation
page read and write
CDB000
heap
page read and write
1364000
heap
page read and write
4021000
heap
page read and write
2D23000
trusted library allocation
page read and write
5CE2000
heap
page read and write
3150000
direct allocation
page read and write
4021000
heap
page read and write
A21000
heap
page read and write
490000
unkown
page read and write
12A0000
trusted library allocation
page execute and read and write
1630000
trusted library allocation
page read and write
4021000
heap
page read and write
3FDB000
heap
page read and write
4AF000
unkown
page readonly
400000
unkown
page readonly
C0B000
heap
page read and write
2F76000
heap
page read and write
5014000
heap
page read and write
2D69000
trusted library allocation
page read and write
29CC000
stack
page read and write
2B10000
trusted library allocation
page read and write
2AF1000
trusted library allocation
page read and write
4021000
heap
page read and write
E60000
heap
page read and write
D30000
trusted library allocation
page read and write
4021000
heap
page read and write
6F9000
stack
page read and write
4021000
heap
page read and write
4021000
heap
page read and write
135F000
heap
page read and write
3F48000
heap
page read and write
E82000
unkown
page readonly
D52000
trusted library allocation
page read and write
12FA000
stack
page read and write
3273000
direct allocation
page read and write
4021000
heap
page read and write
479E000
direct allocation
page read and write
3F84000
heap
page read and write
3F40000
heap
page read and write
2D16000
trusted library allocation
page read and write
10A6000
heap
page read and write
55C9000
trusted library allocation
page read and write
3F62000
heap
page read and write
9AE000
stack
page read and write
A10000
heap
page read and write
C49000
heap
page read and write
1780000
trusted library allocation
page read and write
11DD000
trusted library allocation
page execute and read and write
160E000
stack
page read and write
96C000
stack
page read and write
D70000
trusted library allocation
page read and write
3150000
direct allocation
page read and write
3FDB000
heap
page read and write
13C1000
heap
page read and write
D8C000
heap
page read and write
2BE0000
heap
page read and write
3FDB000
heap
page read and write
3FDB000
heap
page read and write
582E000
stack
page read and write
3FDB000
heap
page read and write
D34000
heap
page read and write
472D000
direct allocation
page read and write
3F36000
heap
page read and write
542E000
stack
page read and write
17C0000
heap
page read and write
4021000
heap
page read and write
11F0000
trusted library allocation
page read and write
133E000
stack
page read and write
3344000
heap
page read and write
8B4000
stack
page read and write
129C000
stack
page read and write
13B4000
heap
page read and write
D2D000
trusted library allocation
page execute and read and write
3FDB000
heap
page read and write
6740000
heap
page read and write
BEE000
stack
page read and write
3FDB000
heap
page read and write
472D000
direct allocation
page read and write
294F000
stack
page read and write
449B000
heap
page read and write
4021000
heap
page read and write
4021000
heap
page read and write
52EE000
stack
page read and write
11FB000
trusted library allocation
page execute and read and write
511C000
stack
page read and write
4729000
direct allocation
page read and write
2B6F000
stack
page read and write
4FE0000
heap
page execute and read and write
D20000
trusted library allocation
page read and write
EDE000
stack
page read and write
11D0000
trusted library allocation
page read and write
472D000
direct allocation
page read and write
3FDB000
heap
page read and write
DC0000
trusted library allocation
page execute and read and write
3FDB000
heap
page read and write
3FDB000
heap
page read and write
4A7000
unkown
page read and write
FE8000
trusted library allocation
page read and write
4021000
heap
page read and write
3BB9000
trusted library allocation
page read and write
60BE000
stack
page read and write
CFA000
stack
page read and write
40F5000
heap
page read and write
525F000
stack
page read and write
3FDB000
heap
page read and write
5000000
heap
page read and write
400000
unkown
page readonly
4021000
heap
page read and write
5C88000
heap
page read and write
3B79000
trusted library allocation
page read and write
4021000
heap
page read and write
400000
system
page execute and read and write
11D4000
trusted library allocation
page read and write
3209000
heap
page read and write
4600000
direct allocation
page read and write
59BE000
stack
page read and write
3273000
direct allocation
page read and write
F80000
heap
page read and write
D46000
trusted library allocation
page execute and read and write
D6F000
heap
page read and write
4729000
direct allocation
page read and write
3FDB000
heap
page read and write
482000
unkown
page readonly
472D000
direct allocation
page read and write
A95000
heap
page read and write
3273000
direct allocation
page read and write
532E000
stack
page read and write
6A70000
heap
page read and write
C46000
heap
page read and write
11B0000
trusted library allocation
page read and write
632E000
stack
page read and write
51AE000
stack
page read and write
3FDB000
heap
page read and write
2B02000
trusted library allocation
page read and write
4090000
heap
page execute and read and write
479E000
direct allocation
page read and write
621D000
trusted library allocation
page read and write
4600000
direct allocation
page read and write
626D000
stack
page read and write
2BDB000
trusted library allocation
page read and write
1800000
trusted library allocation
page read and write
3FDB000
heap
page read and write
6270000
trusted library allocation
page execute and read and write
3FDB000
heap
page read and write
B40000
heap
page read and write
3145000
heap
page read and write
440000
system
page execute and read and write
E65000
heap
page read and write
2B9D000
trusted library allocation
page read and write
2AF6000
trusted library allocation
page read and write
3A8E000
stack
page read and write
100000
heap
page read and write
401000
unkown
page execute read
4021000
heap
page read and write
66FB000
trusted library allocation
page read and write
1654000
trusted library allocation
page read and write
8FE000
stack
page read and write
5830000
heap
page execute and read and write
482000
unkown
page readonly
636E000
stack
page read and write
4600000
direct allocation
page read and write
7F6D0000
trusted library allocation
page execute and read and write
4600000
direct allocation
page read and write
9A000
stack
page read and write
17B0000
trusted library allocation
page execute and read and write
5D23000
heap
page read and write
1650000
trusted library allocation
page read and write
6227000
trusted library allocation
page read and write
5CA0000
heap
page read and write
17E0000
heap
page execute and read and write
4729000
direct allocation
page read and write
10A0000
heap
page read and write
4AB000
unkown
page readonly
FCE000
stack
page read and write
3F4E000
heap
page read and write
3FEA000
heap
page read and write
552F000
stack
page read and write
17CF000
stack
page read and write
E4E000
stack
page read and write
65EC000
stack
page read and write
13CF000
stack
page read and write
60FE000
stack
page read and write
E80000
unkown
page readonly
4729000
direct allocation
page read and write
2B70000
trusted library allocation
page read and write
1340000
heap
page read and write
5ABE000
stack
page read and write
515E000
stack
page read and write
13C8000
heap
page read and write
4E90000
heap
page read and write
2BD2000
trusted library allocation
page read and write
4021000
heap
page read and write
F1C000
stack
page read and write
3CE7000
trusted library allocation
page read and write
3080000
heap
page read and write
13CD000
heap
page read and write
3FDB000
heap
page read and write
4AF000
unkown
page readonly
3FDB000
heap
page read and write
4600000
direct allocation
page read and write
4021000
heap
page read and write
4021000
heap
page read and write
3F43000
heap
page read and write
17A0000
trusted library allocation
page read and write
4021000
heap
page read and write
401000
unkown
page execute read
572E000
stack
page read and write
A60000
heap
page read and write
2950000
heap
page read and write
4191000
trusted library allocation
page read and write
4021000
heap
page read and write
6290000
trusted library allocation
page execute and read and write
9E0000
heap
page read and write
D10000
heap
page read and write
4007000
heap
page read and write
10A0000
heap
page read and write
2980000
heap
page read and write
479E000
direct allocation
page read and write
4021000
heap
page read and write
9FE000
stack
page read and write
3FDB000
heap
page read and write
D18000
heap
page read and write
3140000
heap
page read and write
D24000
trusted library allocation
page read and write
3E90000
heap
page read and write
89F000
stack
page read and write
5010000
heap
page read and write
2ACD000
stack
page read and write
3FDB000
heap
page read and write
1644000
trusted library allocation
page read and write
479E000
direct allocation
page read and write
304C000
stack
page read and write
4021000
heap
page read and write
4600000
direct allocation
page read and write
A20000
heap
page read and write
D42000
trusted library allocation
page read and write
4729000
direct allocation
page read and write
3FDB000
heap
page read and write
17F0000
trusted library allocation
page read and write
5110000
trusted library allocation
page execute and read and write
3FDB000
heap
page read and write
1E0000
heap
page read and write
1810000
trusted library allocation
page execute and read and write
3B51000
trusted library allocation
page read and write
D3A000
heap
page read and write
D10000
trusted library allocation
page read and write
2D60000
trusted library allocation
page read and write
136B000
heap
page read and write
D47000
heap
page read and write
D23000
trusted library allocation
page execute and read and write
3150000
direct allocation
page read and write
6730000
trusted library allocation
page execute and read and write
FD0000
heap
page read and write
13C5000
heap
page read and write
2BF1000
trusted library allocation
page read and write
2B8F000
trusted library allocation
page read and write
4021000
heap
page read and write
6720000
trusted library allocation
page read and write
D5B000
trusted library allocation
page execute and read and write
4D8E000
stack
page read and write
2AEE000
trusted library allocation
page read and write
4021000
heap
page read and write
A70000
heap
page read and write
3F4C000
heap
page read and write
3FD6000
heap
page read and write
4021000
heap
page read and write
4BB000
unkown
page readonly
656E000
stack
page read and write
2970000
trusted library allocation
page read and write
4021000
heap
page read and write
587E000
stack
page read and write
1378000
heap
page read and write
4AB000
unkown
page readonly
2BCA000
trusted library allocation
page read and write
11C4000
trusted library allocation
page read and write
597E000
stack
page read and write
1787000
trusted library allocation
page execute and read and write
479E000
direct allocation
page read and write
11AE000
stack
page read and write
12B0000
trusted library allocation
page read and write
8AF000
stack
page read and write
2BD0000
heap
page execute and read and write
C10000
heap
page read and write
3FDB000
heap
page read and write
3FDB000
heap
page read and write
4094000
heap
page read and write
D4A000
trusted library allocation
page execute and read and write
1670000
heap
page read and write
3273000
direct allocation
page read and write
6280000
trusted library allocation
page read and write
53EE000
stack
page read and write
3FDB000
heap
page read and write
3E8F000
stack
page read and write
FF5000
heap
page read and write
ABE000
heap
page read and write
D2F000
heap
page read and write
165D000
trusted library allocation
page execute and read and write
3FDB000
heap
page read and write
6210000
trusted library allocation
page read and write
B60000
heap
page read and write
66F0000
trusted library allocation
page read and write
125E000
stack
page read and write
CA5000
heap
page read and write
652E000
stack
page read and write
55C0000
trusted library allocation
page read and write
4021000
heap
page read and write
2BC6000
trusted library allocation
page read and write
61FE000
stack
page read and write
3273000
direct allocation
page read and write
D55000
trusted library allocation
page execute and read and write
FF0000
heap
page read and write
1643000
trusted library allocation
page execute and read and write
4BB000
unkown
page readonly
BDE000
heap
page read and write
3273000
direct allocation
page read and write
1210000
trusted library allocation
page read and write
3FDB000
heap
page read and write
2AE2000
trusted library allocation
page read and write
559E000
stack
page read and write
5160000
heap
page execute and read and write
3FDB000
heap
page read and write
3150000
direct allocation
page read and write
472D000
direct allocation
page read and write
318F000
stack
page read and write
3F93000
heap
page read and write
177F000
stack
page read and write
6387000
trusted library allocation
page read and write
BD0000
heap
page read and write
A90000
heap
page read and write
4729000
direct allocation
page read and write
472D000
direct allocation
page read and write
93E000
stack
page read and write
3FDB000
heap
page read and write
C3B000
heap
page read and write
4021000
heap
page read and write
2D71000
trusted library allocation
page read and write
4021000
heap
page read and write
2D45000
trusted library allocation
page read and write
300E000
stack
page read and write
9D0000
heap
page read and write
4091000
heap
page read and write
4021000
heap
page read and write
A9F000
heap
page read and write
BDA000
heap
page read and write
2AFD000
trusted library allocation
page read and write
2ADE000
trusted library allocation
page read and write
3BF1000
trusted library allocation
page read and write
C2F000
heap
page read and write
3FDB000
heap
page read and write
4021000
heap
page read and write
11CD000
trusted library allocation
page execute and read and write
3FDB000
heap
page read and write
5C80000
heap
page read and write
2B86000
trusted library allocation
page read and write
164D000
trusted library allocation
page execute and read and write
3150000
direct allocation
page read and write
3FDB000
heap
page read and write
1348000
heap
page read and write
178B000
trusted library allocation
page execute and read and write
940000
heap
page read and write
490000
unkown
page write copy
4091000
heap
page read and write
315B000
heap
page read and write
4021000
heap
page read and write
There are 402 hidden memdumps, click here to show them.