Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
AL DALEEL ELECT SWITCH GEAR TR LLC. - PO.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\furcation
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\AL DALEEL ELECT SWITCH GEAR TR LLC. - PO.exe
|
"C:\Users\user\Desktop\AL DALEEL ELECT SWITCH GEAR TR LLC. - PO.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\AL DALEEL ELECT SWITCH GEAR TR LLC. - PO.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://api.telegram.org
|
unknown
|
|
|
|
https://api.telegram.org/bot
|
unknown
|
|
|
|
http://checkip.dyndns.org/
|
132.226.8.169
|
||
|
https://api.telegram.org/bot8080123058:AAEYMzGscYJylQTcyvJdcLEtQ0fTBfHxTRc/sendDocument?chat_id=5858
|
unknown
|
||
|
http://checkip.dyndns.org/q
|
unknown
|
||
|
http://reallyfreegeoip.org
|
unknown
|
||
|
https://reallyfreegeoip.org
|
unknown
|
||
|
http://checkip.dyndns.org
|
unknown
|
||
|
http://checkip.dyndns.com
|
unknown
|
||
|
http://api.telegram.org
|
unknown
|
||
|
https://api.telegram.org/bot8080123058:AAEYMzGscYJylQTcyvJdcLEtQ0fTBfHxTRc/sendDocument?chat_id=5858365728&caption=user%20/%20Passwords%20/%20173.254.250.90
|
149.154.167.220
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
https://reallyfreegeoip.org/xml/173.254.250.90
|
188.114.96.3
|
||
|
https://api.telegram.org/bot-/sendDocument?chat_id=
|
unknown
|
||
|
https://reallyfreegeoip.org/xml/
|
unknown
|
There are 5 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
reallyfreegeoip.org
|
188.114.96.3
|
|
|
|
api.telegram.org
|
149.154.167.220
|
|
|
|
checkip.dyndns.org
|
unknown
|
|
|
|
checkip.dyndns.com
|
132.226.8.169
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
149.154.167.220
|
api.telegram.org
|
United Kingdom
|
|
|
|
188.114.96.3
|
reallyfreegeoip.org
|
European Union
|
|
|
|
132.226.8.169
|
checkip.dyndns.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
402000
|
system
|
page execute and read and write
|
|
|
|
2A9B000
|
trusted library allocation
|
page read and write
|
|
|
|
39F0000
|
direct allocation
|
page read and write
|
|
|
|
A10000
|
heap
|
page read and write
|
||
|
40F9000
|
direct allocation
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
5C6E000
|
stack
|
page read and write
|
||
|
3B84000
|
heap
|
page read and write
|
||
|
3B83000
|
heap
|
page read and write
|
||
|
699000
|
stack
|
page read and write
|
||
|
7D0000
|
heap
|
page read and write
|
||
|
4AB000
|
unkown
|
page readonly
|
||
|
9A000
|
stack
|
page read and write
|
||
|
29E2000
|
trusted library allocation
|
page read and write
|
||
|
6480000
|
trusted library allocation
|
page execute and read and write
|
||
|
3F53000
|
direct allocation
|
page read and write
|
||
|
E05000
|
trusted library allocation
|
page execute and read and write
|
||
|
3941000
|
trusted library allocation
|
page read and write
|
||
|
DFA000
|
trusted library allocation
|
page execute and read and write
|
||
|
B18000
|
heap
|
page read and write
|
||
|
3C33000
|
heap
|
page execute and read and write
|
||
|
3A20000
|
heap
|
page read and write
|
||
|
DED000
|
trusted library allocation
|
page execute and read and write
|
||
|
40DD000
|
direct allocation
|
page read and write
|
||
|
623E000
|
stack
|
page read and write
|
||
|
4F00000
|
heap
|
page read and write
|
||
|
41A000
|
system
|
page execute and read and write
|
||
|
110000
|
heap
|
page read and write
|
||
|
5F70000
|
heap
|
page read and write
|
||
|
2930000
|
heap
|
page execute and read and write
|
||
|
354E000
|
stack
|
page read and write
|
||
|
3F53000
|
direct allocation
|
page read and write
|
||
|
E02000
|
trusted library allocation
|
page read and write
|
||
|
5100000
|
trusted library allocation
|
page read and write
|
||
|
5E17000
|
heap
|
page read and write
|
||
|
4F03000
|
heap
|
page read and write
|
||
|
6461000
|
trusted library allocation
|
page read and write
|
||
|
490000
|
unkown
|
page read and write
|
||
|
93E000
|
stack
|
page read and write
|
||
|
3B4B000
|
heap
|
page read and write
|
||
|
2A21000
|
trusted library allocation
|
page read and write
|
||
|
9CE000
|
stack
|
page read and write
|
||
|
2A48000
|
trusted library allocation
|
page read and write
|
||
|
3E10000
|
direct allocation
|
page read and write
|
||
|
29A6000
|
trusted library allocation
|
page read and write
|
||
|
2A04000
|
trusted library allocation
|
page read and write
|
||
|
126E000
|
stack
|
page read and write
|
||
|
64C0000
|
heap
|
page read and write
|
||
|
DC0000
|
trusted library allocation
|
page read and write
|
||
|
2A58000
|
trusted library allocation
|
page read and write
|
||
|
5CAE000
|
stack
|
page read and write
|
||
|
3FD0000
|
direct allocation
|
page read and write
|
||
|
3E10000
|
direct allocation
|
page read and write
|
||
|
4DB2000
|
trusted library allocation
|
page read and write
|
||
|
E90000
|
trusted library allocation
|
page read and write
|
||
|
DF2000
|
trusted library allocation
|
page read and write
|
||
|
2A2C000
|
trusted library allocation
|
page read and write
|
||
|
4DE0000
|
trusted library allocation
|
page read and write
|
||
|
4E7E000
|
stack
|
page read and write
|
||
|
4E10000
|
trusted library allocation
|
page read and write
|
||
|
29FB000
|
trusted library allocation
|
page read and write
|
||
|
4DBE000
|
trusted library allocation
|
page read and write
|
||
|
8FE000
|
stack
|
page read and write
|
||
|
AE0000
|
heap
|
page read and write
|
||
|
5110000
|
heap
|
page execute and read and write
|
||
|
3BC3000
|
heap
|
page read and write
|
||
|
40F9000
|
direct allocation
|
page read and write
|
||
|
950000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
29B4000
|
trusted library allocation
|
page read and write
|
||
|
40D9000
|
direct allocation
|
page read and write
|
||
|
5DAE000
|
stack
|
page read and write
|
||
|
E6E000
|
stack
|
page read and write
|
||
|
549E000
|
stack
|
page read and write
|
||
|
2A35000
|
trusted library allocation
|
page read and write
|
||
|
5F10000
|
trusted library allocation
|
page execute and read and write
|
||
|
4AB000
|
unkown
|
page readonly
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
A60000
|
heap
|
page read and write
|
||
|
3FB0000
|
direct allocation
|
page read and write
|
||
|
2A5E000
|
trusted library allocation
|
page read and write
|
||
|
3F53000
|
direct allocation
|
page read and write
|
||
|
4DF0000
|
trusted library allocation
|
page read and write
|
||
|
5EC0000
|
trusted library allocation
|
page execute and read and write
|
||
|
3956000
|
heap
|
page read and write
|
||
|
54B6000
|
trusted library allocation
|
page read and write
|
||
|
3E30000
|
direct allocation
|
page read and write
|
||
|
2B59000
|
trusted library allocation
|
page read and write
|
||
|
3C24000
|
heap
|
page read and write
|
||
|
40FD000
|
direct allocation
|
page read and write
|
||
|
414E000
|
direct allocation
|
page read and write
|
||
|
3C23000
|
heap
|
page read and write
|
||
|
4DD2000
|
trusted library allocation
|
page read and write
|
||
|
4A7000
|
unkown
|
page read and write
|
||
|
8AF000
|
stack
|
page read and write
|
||
|
2A44000
|
trusted library allocation
|
page read and write
|
||
|
3AD8000
|
heap
|
page read and write
|
||
|
4DCD000
|
trusted library allocation
|
page read and write
|
||
|
B0A000
|
heap
|
page read and write
|
||
|
A40000
|
heap
|
page read and write
|
||
|
3C23000
|
heap
|
page read and write
|
||
|
2941000
|
trusted library allocation
|
page read and write
|
||
|
DD0000
|
trusted library allocation
|
page read and write
|
||
|
3BC3000
|
heap
|
page read and write
|
||
|
A45000
|
heap
|
page read and write
|
||
|
5EB0000
|
trusted library allocation
|
page execute and read and write
|
||
|
396D000
|
trusted library allocation
|
page read and write
|
||
|
416E000
|
direct allocation
|
page read and write
|
||
|
5DF6000
|
heap
|
page read and write
|
||
|
DD4000
|
trusted library allocation
|
page read and write
|
||
|
6450000
|
trusted library allocation
|
page read and write
|
||
|
4DBA000
|
trusted library allocation
|
page read and write
|
||
|
3B59000
|
heap
|
page read and write
|
||
|
40DD000
|
direct allocation
|
page read and write
|
||
|
3C37000
|
heap
|
page read and write
|
||
|
60FE000
|
stack
|
page read and write
|
||
|
29C0000
|
trusted library allocation
|
page read and write
|
||
|
3A56000
|
heap
|
page read and write
|
||
|
B9F000
|
heap
|
page read and write
|
||
|
54A0000
|
trusted library allocation
|
page read and write
|
||
|
4DA6000
|
trusted library allocation
|
page read and write
|
||
|
416E000
|
direct allocation
|
page read and write
|
||
|
29A3000
|
trusted library allocation
|
page read and write
|
||
|
531E000
|
stack
|
page read and write
|
||
|
4DAB000
|
trusted library allocation
|
page read and write
|
||
|
3C23000
|
heap
|
page read and write
|
||
|
60AF000
|
stack
|
page read and write
|
||
|
AAA000
|
heap
|
page read and write
|
||
|
54A3000
|
trusted library allocation
|
page read and write
|
||
|
7D5000
|
heap
|
page read and write
|
||
|
54B4000
|
trusted library allocation
|
page read and write
|
||
|
E07000
|
trusted library allocation
|
page execute and read and write
|
||
|
29AB000
|
trusted library allocation
|
page read and write
|
||
|
29BE000
|
trusted library allocation
|
page read and write
|
||
|
A70000
|
heap
|
page read and write
|
||
|
2B19000
|
trusted library allocation
|
page read and write
|
||
|
61FF000
|
stack
|
page read and write
|
||
|
6490000
|
trusted library allocation
|
page read and write
|
||
|
A7A000
|
heap
|
page read and write
|
||
|
414E000
|
direct allocation
|
page read and write
|
||
|
521E000
|
stack
|
page read and write
|
||
|
4DC1000
|
trusted library allocation
|
page read and write
|
||
|
490000
|
unkown
|
page write copy
|
||
|
416E000
|
direct allocation
|
page read and write
|
||
|
5E01000
|
heap
|
page read and write
|
||
|
797000
|
stack
|
page read and write
|
||
|
67FE000
|
stack
|
page read and write
|
||
|
F0000
|
heap
|
page read and write
|
||
|
DE0000
|
trusted library allocation
|
page read and write
|
||
|
40D9000
|
direct allocation
|
page read and write
|
||
|
166F000
|
stack
|
page read and write
|
||
|
2A26000
|
trusted library allocation
|
page read and write
|
||
|
EA0000
|
heap
|
page read and write
|
||
|
5E0D000
|
heap
|
page read and write
|
||
|
3964000
|
trusted library allocation
|
page read and write
|
||
|
3FD0000
|
direct allocation
|
page read and write
|
||
|
3E10000
|
direct allocation
|
page read and write
|
||
|
3E30000
|
direct allocation
|
page read and write
|
||
|
4EFE000
|
stack
|
page read and write
|
||
|
5E06000
|
heap
|
page read and write
|
||
|
3BC3000
|
heap
|
page read and write
|
||
|
3F33000
|
direct allocation
|
page read and write
|
||
|
E0B000
|
trusted library allocation
|
page execute and read and write
|
||
|
29ED000
|
trusted library allocation
|
page read and write
|
||
|
29FF000
|
trusted library allocation
|
page read and write
|
||
|
A70000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
414E000
|
direct allocation
|
page read and write
|
||
|
66FE000
|
stack
|
page read and write
|
||
|
AFE000
|
heap
|
page read and write
|
||
|
39ED000
|
trusted library allocation
|
page read and write
|
||
|
9D0000
|
heap
|
page read and write
|
||
|
3979000
|
trusted library allocation
|
page read and write
|
||
|
2A65000
|
trusted library allocation
|
page read and write
|
||
|
3B20000
|
heap
|
page read and write
|
||
|
2B55000
|
trusted library allocation
|
page read and write
|
||
|
960000
|
heap
|
page read and write
|
||
|
4EBE000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
BD1000
|
heap
|
page read and write
|
||
|
89F000
|
stack
|
page read and write
|
||
|
2A3F000
|
trusted library allocation
|
page read and write
|
||
|
2A60000
|
trusted library allocation
|
page read and write
|
||
|
3AF5000
|
heap
|
page read and write
|
||
|
39B1000
|
trusted library allocation
|
page read and write
|
||
|
3E30000
|
direct allocation
|
page read and write
|
||
|
39E0000
|
heap
|
page read and write
|
||
|
A7E000
|
heap
|
page read and write
|
||
|
40FD000
|
direct allocation
|
page read and write
|
||
|
AE8000
|
heap
|
page read and write
|
||
|
DF0000
|
trusted library allocation
|
page read and write
|
||
|
DDD000
|
trusted library allocation
|
page execute and read and write
|
||
|
4DC6000
|
trusted library allocation
|
page read and write
|
||
|
644F000
|
stack
|
page read and write
|
||
|
4A3E000
|
stack
|
page read and write
|
||
|
3F33000
|
direct allocation
|
page read and write
|
||
|
4DA0000
|
trusted library allocation
|
page read and write
|
||
|
5DE2000
|
heap
|
page read and write
|
||
|
482000
|
unkown
|
page readonly
|
||
|
400000
|
unkown
|
page readonly
|
||
|
4DAE000
|
trusted library allocation
|
page read and write
|
||
|
3F33000
|
direct allocation
|
page read and write
|
||
|
2B17000
|
trusted library allocation
|
page read and write
|
||
|
2A6B000
|
trusted library allocation
|
page read and write
|
||
|
40FD000
|
direct allocation
|
page read and write
|
||
|
8B4000
|
stack
|
page read and write
|
||
|
E70000
|
trusted library allocation
|
page execute and read and write
|
||
|
A2E000
|
stack
|
page read and write
|
||
|
5DB0000
|
heap
|
page read and write
|
||
|
3B59000
|
heap
|
page read and write
|
||
|
66B0000
|
heap
|
page read and write
|
||
|
40F9000
|
direct allocation
|
page read and write
|
||
|
292D000
|
stack
|
page read and write
|
||
|
541E000
|
stack
|
page read and write
|
||
|
394F000
|
stack
|
page read and write
|
||
|
3FD0000
|
direct allocation
|
page read and write
|
||
|
29F7000
|
trusted library allocation
|
page read and write
|
||
|
5F0E000
|
stack
|
page read and write
|
||
|
40D9000
|
direct allocation
|
page read and write
|
||
|
40DD000
|
direct allocation
|
page read and write
|
||
|
E80000
|
heap
|
page read and write
|
||
|
6470000
|
trusted library allocation
|
page read and write
|
||
|
9D4000
|
heap
|
page read and write
|
||
|
54BA000
|
trusted library allocation
|
page read and write
|
||
|
3FB0000
|
direct allocation
|
page read and write
|
||
|
DF6000
|
trusted library allocation
|
page execute and read and write
|
||
|
DD3000
|
trusted library allocation
|
page execute and read and write
|
||
|
482000
|
unkown
|
page readonly
|
||
|
284F000
|
stack
|
page read and write
|
||
|
3FB0000
|
direct allocation
|
page read and write
|
||
|
6468000
|
trusted library allocation
|
page read and write
|
||
|
4D80000
|
heap
|
page read and write
|
There are 222 hidden memdumps, click here to show them.