IOC Report
QUOTATIONS#08673.exe

loading gif

Files

File Path
Type
Category
Malicious
QUOTATIONS#08673.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\newapp.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\hypopygidium
data
dropped
C:\Users\user\AppData\Roaming\newapp\newapp.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
modified
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\QUOTATIONS#08673.exe
"C:\Users\user\Desktop\QUOTATIONS#08673.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\QUOTATIONS#08673.exe"
 malicious
C:\Users\user\AppData\Roaming\newapp\newapp.exe
"C:\Users\user\AppData\Roaming\newapp\newapp.exe"
malicious
C:\Users\user\AppData\Roaming\newapp\newapp.exe
"C:\Users\user\AppData\Roaming\newapp\newapp.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.13.205
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ftp.ercolina-usa.com
unknown
http://ercolina-usa.com
unknown

Domains

Name
IP
Malicious
ercolina-usa.com
192.254.225.136
 malicious
ftp.ercolina-usa.com
unknown
 malicious
api.ipify.org
104.26.13.205

IPs

IP
Domain
Country
Malicious
192.254.225.136
ercolina-usa.com
United States
malicious
104.26.13.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
newapp
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
286C000
trusted library allocation
page read and write
 malicious
7A2000
system
page execute and read and write
 malicious
2841000
trusted library allocation
page read and write
 malicious
2FC0000
direct allocation
page read and write
 malicious
1A30000
trusted library allocation
page read and write
37F1000
trusted library allocation
page read and write
2320000
heap
page read and write
A45000
trusted library allocation
page execute and read and write
8BF000
stack
page read and write
A80000
heap
page read and write
4BE000
unkown
page readonly
3CF6000
heap
page read and write
3DF9000
heap
page read and write
51D0000
heap
page read and write
177E000
stack
page read and write
3DF9000
heap
page read and write
4420000
direct allocation
page read and write
65D000
trusted library allocation
page execute and read and write
745000
heap
page read and write
482000
unkown
page readonly
5B1E000
stack
page read and write
475E000
direct allocation
page read and write
48EE000
stack
page read and write
AC8000
heap
page read and write
27AB000
trusted library allocation
page read and write
2411000
trusted library allocation
page read and write
A4E000
stack
page read and write
6840000
heap
page read and write
5080000
heap
page read and write
5E70000
trusted library allocation
page read and write
46ED000
direct allocation
page read and write
51BE000
stack
page read and write
A00000
trusted library allocation
page read and write
5890000
heap
page execute and read and write
1A0000
heap
page read and write
45C0000
direct allocation
page read and write
ABA000
heap
page read and write
45C0000
direct allocation
page read and write
A42000
trusted library allocation
page read and write
30B0000
trusted library allocation
page read and write
59FF000
heap
page read and write
4543000
direct allocation
page read and write
59B0000
heap
page read and write
A14000
trusted library allocation
page read and write
A74000
heap
page read and write
D8E000
stack
page read and write
16AF000
stack
page read and write
4EFE000
stack
page read and write
3E07000
heap
page read and write
91F000
stack
page read and write
45C0000
direct allocation
page read and write
3097000
trusted library allocation
page execute and read and write
4C30000
trusted library allocation
page read and write
4420000
direct allocation
page read and write
3EEF000
heap
page read and write
475E000
direct allocation
page read and write
8D5000
heap
page read and write
598E000
stack
page read and write
45AE000
stack
page read and write
27CD000
trusted library allocation
page read and write
7A0000
system
page execute and read and write
1A50000
trusted library allocation
page read and write
A98000
heap
page read and write
B68000
heap
page read and write
4EAC000
stack
page read and write
490000
unkown
page write copy
542E000
stack
page read and write
4331000
trusted library allocation
page read and write
64E0000
trusted library allocation
page read and write
475E000
direct allocation
page read and write
46ED000
direct allocation
page read and write
5FDD000
trusted library allocation
page read and write
3DF9000
heap
page read and write
4543000
direct allocation
page read and write
46E9000
direct allocation
page read and write
332F000
stack
page read and write
AEF000
heap
page read and write
494E000
stack
page read and write
A20000
trusted library allocation
page read and write
100000
heap
page read and write
5E79000
trusted library allocation
page read and write
ABA000
heap
page read and write
475E000
direct allocation
page read and write
E46000
heap
page read and write
5A46000
heap
page read and write
3F36000
heap
page read and write
400000
unkown
page readonly
13C000
stack
page read and write
2868000
trusted library allocation
page read and write
14E0000
heap
page read and write
23B0000
trusted library allocation
page execute and read and write
45C0000
direct allocation
page read and write
5C1E000
stack
page read and write
4F9000
stack
page read and write
B22000
heap
page read and write
26EE000
stack
page read and write
3331000
trusted library allocation
page read and write
4DAC000
stack
page read and write
A70000
heap
page read and write
67D000
trusted library allocation
page execute and read and write
A30000
trusted library allocation
page read and write
166E000
stack
page read and write
475E000
direct allocation
page read and write
3D0F000
heap
page read and write
960000
heap
page read and write
3220000
heap
page execute and read and write
3F28000
heap
page read and write
13E0000
heap
page read and write
3B51000
heap
page read and write
E40000
heap
page read and write
5ADE000
stack
page read and write
27D2000
trusted library allocation
page read and write
3D06000
heap
page read and write
3DF9000
heap
page read and write
46ED000
direct allocation
page read and write
4420000
direct allocation
page read and write
3986000
trusted library allocation
page read and write
4A7000
unkown
page read and write
46E9000
direct allocation
page read and write
46ED000
direct allocation
page read and write
282F000
trusted library allocation
page read and write
74B000
heap
page read and write
27A0000
trusted library allocation
page read and write
665000
heap
page read and write
4AE000
unkown
page readonly
3EEE000
heap
page read and write
3EEF000
heap
page read and write
66A000
stack
page read and write
3E51000
heap
page read and write
A32000
trusted library allocation
page read and write
C8C000
stack
page read and write
13FF000
heap
page read and write
AB0000
heap
page read and write
654000
trusted library allocation
page read and write
599A000
heap
page read and write
8D0000
heap
page read and write
5A6C000
heap
page read and write
49B0000
heap
page execute and read and write
4258000
heap
page read and write
3B50000
heap
page read and write
E0C000
stack
page read and write
50CE000
stack
page read and write
4543000
direct allocation
page read and write
AC5000
heap
page read and write
3EEF000
heap
page read and write
3EEF000
heap
page read and write
3F0C000
heap
page read and write
490000
unkown
page read and write
3EEE000
heap
page read and write
3EEF000
heap
page read and write
4543000
direct allocation
page read and write
640000
trusted library allocation
page read and write
3EEF000
heap
page read and write
3DF9000
heap
page read and write
3F36000
heap
page read and write
3DF9000
heap
page read and write
653000
trusted library allocation
page execute and read and write
3000000
heap
page read and write
1404000
heap
page read and write
5D0E000
stack
page read and write
A10000
trusted library allocation
page read and write
27E0000
heap
page read and write
4420000
direct allocation
page read and write
AAE000
heap
page read and write
29E5000
trusted library allocation
page read and write
6FE000
stack
page read and write
27C1000
trusted library allocation
page read and write
840000
heap
page read and write
3DF9000
heap
page read and write
9C0000
heap
page read and write
674000
trusted library allocation
page read and write
A60000
trusted library allocation
page read and write
3D4B000
heap
page read and write
60EF000
stack
page read and write
3D0C000
heap
page read and write
313C000
stack
page read and write
60E000
stack
page read and write
4BC000
unkown
page readonly
3DF8000
heap
page read and write
95C000
stack
page read and write
3EEF000
heap
page read and write
588E000
stack
page read and write
820000
heap
page read and write
728000
heap
page read and write
4AB000
unkown
page readonly
B61000
heap
page read and write
503E000
stack
page read and write
162E000
stack
page read and write
2826000
trusted library allocation
page read and write
45C0000
direct allocation
page read and write
3819000
trusted library allocation
page read and write
E30000
trusted library allocation
page read and write
475E000
direct allocation
page read and write
3DF9000
heap
page read and write
4543000
direct allocation
page read and write
27C6000
trusted library allocation
page read and write
46ED000
direct allocation
page read and write
3E8F000
heap
page read and write
91E000
stack
page read and write
720000
heap
page read and write
3C50000
heap
page read and write
3DF9000
heap
page read and write
231F000
stack
page read and write
46E9000
direct allocation
page read and write
12AE000
stack
page read and write
AE6000
heap
page read and write
45C0000
direct allocation
page read and write
FE2000
unkown
page readonly
1A54000
trusted library allocation
page read and write
1A43000
trusted library allocation
page execute and read and write
287B000
trusted library allocation
page read and write
3DF9000
heap
page read and write
5990000
heap
page read and write
A85000
heap
page read and write
3BE2000
heap
page read and write
A3A000
trusted library allocation
page execute and read and write
140B000
heap
page read and write
30FE000
stack
page read and write
1F0000
heap
page read and write
A00000
heap
page read and write
46E9000
direct allocation
page read and write
1F0000
heap
page read and write
A4B000
trusted library allocation
page execute and read and write
127C000
stack
page read and write
3E61000
heap
page read and write
5770000
trusted library allocation
page read and write
6030000
trusted library allocation
page execute and read and write
599C000
heap
page read and write
700000
trusted library allocation
page execute and read and write
612C000
stack
page read and write
27B2000
trusted library allocation
page read and write
3F20000
heap
page read and write
8CF000
stack
page read and write
4FFE000
stack
page read and write
3200000
heap
page read and write
3F24000
heap
page execute and read and write
3EEF000
heap
page read and write
4420000
direct allocation
page read and write
6050000
trusted library allocation
page execute and read and write
7E0000
system
page execute and read and write
2340000
trusted library allocation
page read and write
62EC000
stack
page read and write
64B0000
trusted library allocation
page read and write
3DF9000
heap
page read and write
FEA000
unkown
page readonly
1A60000
heap
page read and write
A2D000
trusted library allocation
page execute and read and write
6040000
trusted library allocation
page read and write
2A15000
trusted library allocation
page read and write
3E8F000
heap
page read and write
ABE000
heap
page read and write
3DB2000
heap
page read and write
46ED000
direct allocation
page read and write
DCE000
stack
page read and write
4AB000
unkown
page readonly
E10000
trusted library allocation
page read and write
3E50000
heap
page read and write
9A000
stack
page read and write
602D000
stack
page read and write
5FE7000
trusted library allocation
page read and write
3F36000
heap
page read and write
27AE000
trusted library allocation
page read and write
69B000
trusted library allocation
page execute and read and write
3DF9000
heap
page read and write
5FE0000
trusted library allocation
page read and write
793000
heap
page read and write
1515000
heap
page read and write
3004000
heap
page read and write
A90000
heap
page read and write
3F0C000
heap
page read and write
6140000
trusted library allocation
page read and write
697000
trusted library allocation
page execute and read and write
400000
unkown
page readonly
3D9A000
heap
page read and write
2866000
trusted library allocation
page read and write
3BC3000
heap
page read and write
A90000
heap
page read and write
46ED000
direct allocation
page read and write
6500000
heap
page read and write
1417000
heap
page read and write
4543000
direct allocation
page read and write
2A21000
trusted library allocation
page read and write
5780000
trusted library allocation
page read and write
3150000
heap
page read and write
2790000
heap
page execute and read and write
45C0000
direct allocation
page read and write
3F25000
heap
page read and write
46E9000
direct allocation
page read and write
A70000
heap
page read and write
4C60000
heap
page execute and read and write
3EEE000
heap
page read and write
5FD0000
trusted library allocation
page read and write
137A000
stack
page read and write
A13000
trusted library allocation
page execute and read and write
4AE000
unkown
page readonly
4BFE000
stack
page read and write
2E5F000
heap
page read and write
A47000
trusted library allocation
page execute and read and write
2A09000
trusted library allocation
page read and write
482000
unkown
page readonly
498E000
stack
page read and write
4420000
direct allocation
page read and write
4CFF000
stack
page read and write
4BE000
unkown
page readonly
475E000
direct allocation
page read and write
5C0D000
stack
page read and write
1A4D000
trusted library allocation
page execute and read and write
660000
heap
page read and write
3EEF000
heap
page read and write
3B4F000
stack
page read and write
3DE3000
heap
page read and write
1EE000
stack
page read and write
27F1000
trusted library allocation
page read and write
3F20000
heap
page read and write
3DF9000
heap
page read and write
110000
heap
page read and write
E20000
trusted library allocation
page read and write
13E8000
heap
page read and write
2A19000
trusted library allocation
page read and write
7F090000
trusted library allocation
page execute and read and write
769000
stack
page read and write
1A44000
trusted library allocation
page read and write
4ABE000
stack
page read and write
374E000
stack
page read and write
401000
unkown
page execute read
6147000
trusted library allocation
page read and write
59DE000
stack
page read and write
95E000
stack
page read and write
670000
trusted library allocation
page read and write
3858000
trusted library allocation
page read and write
46E9000
direct allocation
page read and write
4BC000
unkown
page readonly
757000
heap
page read and write
6130000
trusted library allocation
page execute and read and write
26F8000
trusted library allocation
page read and write
588E000
stack
page read and write
970000
heap
page read and write
27BE000
trusted library allocation
page read and write
3EEF000
heap
page read and write
599E000
stack
page read and write
5EBE000
stack
page read and write
A36000
trusted library allocation
page execute and read and write
88C000
stack
page read and write
5820000
trusted library allocation
page execute and read and write
9DE000
stack
page read and write
5D4E000
stack
page read and write
286A000
trusted library allocation
page read and write
A6F000
stack
page read and write
3411000
trusted library allocation
page read and write
3DF9000
heap
page read and write
2A00000
trusted library allocation
page read and write
2872000
trusted library allocation
page read and write
4314000
heap
page read and write
A1D000
trusted library allocation
page execute and read and write
3CFF000
heap
page read and write
14F0000
heap
page read and write
A80000
trusted library allocation
page execute and read and write
145A000
heap
page read and write
3EEF000
heap
page read and write
3DF9000
heap
page read and write
3E51000
heap
page read and write
3E51000
heap
page read and write
4420000
direct allocation
page read and write
283D000
trusted library allocation
page read and write
3140000
trusted library allocation
page execute and read and write
2400000
heap
page read and write
8CE000
stack
page read and write
1670000
heap
page read and write
1510000
heap
page read and write
187F000
stack
page read and write
46E9000
direct allocation
page read and write
4C70000
heap
page read and write
4BBE000
stack
page read and write
64BB000
trusted library allocation
page read and write
4543000
direct allocation
page read and write
5E4E000
stack
page read and write
29B6000
trusted library allocation
page read and write
3090000
trusted library allocation
page read and write
401000
unkown
page execute read
507E000
unkown
page read and write
2370000
heap
page execute and read and write
FE0000
unkown
page readonly
1A5D000
trusted library allocation
page execute and read and write
710000
trusted library allocation
page read and write
309B000
trusted library allocation
page execute and read and write
29C3000
trusted library allocation
page read and write
5FBE000
stack
page read and write
3F1D000
heap
page read and write
64F0000
trusted library allocation
page execute and read and write
830000
heap
page read and write
3EEF000
heap
page read and write
There are 381 hidden memdumps, click here to show them.