IOC Report
INVOICE.exe

loading gif

Files

File Path
Type
Category
Malicious
INVOICE.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\Ramada
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\INVOICE.exe
"C:\Users\user\Desktop\INVOICE.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\INVOICE.exe"
 malicious

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
132.226.8.169
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/155.94.241.188$
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://reallyfreegeoip.org/xml/155.94.241.188
188.114.97.3
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.97.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
132.226.8.169

IPs

IP
Domain
Country
Malicious
188.114.97.3
reallyfreegeoip.org
European Union
malicious
132.226.8.169
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2944000
heap
page read and write
 malicious
3186000
trusted library allocation
page read and write
 malicious
3F51000
trusted library allocation
page read and write
 malicious
2FB9000
trusted library allocation
page read and write
 malicious
2E50000
trusted library section
page read and write
 malicious
2ED0000
trusted library section
page read and write
 malicious
2F83000
trusted library allocation
page read and write
9DE000
stack
page read and write
477E000
direct allocation
page read and write
2D2E000
stack
page read and write
D77000
heap
page read and write
4563000
direct allocation
page read and write
30BC000
trusted library allocation
page read and write
67A8000
trusted library allocation
page read and write
313D000
trusted library allocation
page read and write
541E000
stack
page read and write
45E0000
direct allocation
page read and write
2B80000
trusted library allocation
page read and write
401000
unkown
page execute read
D34000
heap
page read and write
27D0000
heap
page read and write
3DB4000
heap
page read and write
1E0000
heap
page read and write
2916000
trusted library allocation
page execute and read and write
65EE000
stack
page read and write
2D30000
trusted library allocation
page read and write
2A50000
trusted library allocation
page read and write
2AD0000
heap
page read and write
36CE000
stack
page read and write
4709000
direct allocation
page read and write
482000
unkown
page readonly
538E000
stack
page read and write
2F10000
heap
page execute and read and write
45E0000
direct allocation
page read and write
2F6A000
trusted library allocation
page read and write
5926000
trusted library allocation
page read and write
980000
heap
page read and write
4440000
direct allocation
page read and write
2FA2000
trusted library allocation
page read and write
123E000
stack
page read and write
2FAF000
trusted library allocation
page read and write
676E000
stack
page read and write
C90000
trusted library section
page read and write
4A7000
unkown
page read and write
2EAE000
trusted library allocation
page read and write
67B0000
trusted library allocation
page execute and read and write
9A000
stack
page read and write
3ADD000
heap
page read and write
4563000
direct allocation
page read and write
2AB0000
trusted library allocation
page read and write
400000
unkown
page readonly
93E000
stack
page read and write
3DCC000
heap
page read and write
30C4000
trusted library allocation
page read and write
4AB000
unkown
page readonly
306A000
trusted library allocation
page read and write
2F5C000
trusted library allocation
page read and write
2B90000
trusted library allocation
page read and write
400000
system
page execute and read and write
3DCF000
heap
page read and write
55E0000
heap
page read and write
28F0000
trusted library allocation
page read and write
642D000
stack
page read and write
3F30000
heap
page read and write
D0B000
heap
page read and write
400000
unkown
page readonly
3E6F000
heap
page read and write
477E000
direct allocation
page read and write
1F0000
heap
page read and write
28DE000
stack
page read and write
2F85000
trusted library allocation
page read and write
3F83000
heap
page read and write
65AF000
stack
page read and write
CA0000
heap
page read and write
3F7F000
heap
page read and write
290D000
trusted library allocation
page execute and read and write
3104000
trusted library allocation
page read and write
2F9A000
trusted library allocation
page read and write
67D1000
trusted library allocation
page read and write
2FA6000
trusted library allocation
page read and write
2F40000
heap
page read and write
3DD4000
heap
page read and write
A2E000
stack
page read and write
5930000
trusted library allocation
page read and write
2912000
trusted library allocation
page read and write
DDE000
stack
page read and write
950000
heap
page read and write
477E000
direct allocation
page read and write
3DC7000
heap
page read and write
3248000
trusted library allocation
page read and write
4042000
trusted library allocation
page read and write
5924000
trusted library allocation
page read and write
3B5D000
heap
page read and write
4563000
direct allocation
page read and write
2F6C000
trusted library allocation
page read and write
404E000
trusted library allocation
page read and write
6780000
trusted library allocation
page execute and read and write
4709000
direct allocation
page read and write
2EB6000
trusted library allocation
page read and write
68D0000
heap
page read and write
8B4000
stack
page read and write
490000
unkown
page read and write
3236000
trusted library allocation
page read and write
4563000
direct allocation
page read and write
2F71000
trusted library allocation
page read and write
4709000
direct allocation
page read and write
3F31000
heap
page read and write
2F85000
heap
page read and write
9F6000
stack
page read and write
A40000
heap
page read and write
2F44000
heap
page read and write
6770000
trusted library allocation
page execute and read and write
3ACF000
stack
page read and write
CA8000
heap
page read and write
89F000
stack
page read and write
662F000
stack
page read and write
482000
unkown
page readonly
2E90000
trusted library allocation
page read and write
2D40000
heap
page read and write
30FC000
trusted library allocation
page read and write
3FE0000
trusted library allocation
page read and write
310C000
trusted library allocation
page read and write
2F81000
trusted library allocation
page read and write
163F000
stack
page read and write
3DE2000
heap
page read and write
3F87000
heap
page read and write
4709000
direct allocation
page read and write
4709000
direct allocation
page read and write
2900000
trusted library allocation
page read and write
31F0000
trusted library allocation
page read and write
6790000
trusted library allocation
page execute and read and write
2903000
trusted library allocation
page read and write
2F77000
trusted library allocation
page read and write
43B000
system
page execute and read and write
3279000
trusted library allocation
page read and write
2FB7000
trusted library allocation
page read and write
55F4000
heap
page read and write
CE1000
heap
page read and write
2F68000
trusted library allocation
page read and write
4440000
direct allocation
page read and write
3099000
trusted library allocation
page read and write
3114000
trusted library allocation
page read and write
CD0000
heap
page read and write
2910000
trusted library allocation
page read and write
2EBD000
trusted library allocation
page read and write
2F40000
heap
page execute and read and write
30B8000
trusted library allocation
page read and write
470D000
direct allocation
page read and write
1800000
heap
page read and write
2E43000
heap
page read and write
2E9B000
trusted library allocation
page read and write
5390000
trusted library allocation
page read and write
4563000
direct allocation
page read and write
2A3B000
trusted library allocation
page execute and read and write
323C000
trusted library allocation
page read and write
A74000
heap
page read and write
2E9E000
trusted library allocation
page read and write
28F4000
trusted library allocation
page read and write
4039000
trusted library allocation
page read and write
2E4E000
stack
page read and write
C70000
heap
page read and write
6870000
heap
page read and write
323E000
trusted library allocation
page read and write
4440000
direct allocation
page read and write
55EC000
heap
page read and write
CDD000
heap
page read and write
2F94000
trusted library allocation
page read and write
28E0000
trusted library allocation
page read and write
1820000
heap
page read and write
45E0000
direct allocation
page read and write
3B50000
direct allocation
page read and write
67A0000
trusted library allocation
page read and write
3166000
trusted library allocation
page read and write
2F8D000
trusted library allocation
page read and write
FCE000
stack
page read and write
470D000
direct allocation
page read and write
477E000
direct allocation
page read and write
2F9E000
trusted library allocation
page read and write
5420000
trusted library allocation
page read and write
401000
unkown
page execute read
2FA9000
trusted library allocation
page read and write
2CED000
stack
page read and write
2F6E000
trusted library allocation
page read and write
306F000
trusted library allocation
page read and write
470D000
direct allocation
page read and write
1F5000
heap
page read and write
2F62000
trusted library allocation
page read and write
2F80000
heap
page read and write
2AD3000
heap
page read and write
5622000
heap
page read and write
2A32000
trusted library allocation
page read and write
3100000
trusted library allocation
page read and write
3F82000
heap
page execute and read and write
30F8000
trusted library allocation
page read and write
2F89000
trusted library allocation
page read and write
2F66000
trusted library allocation
page read and write
3D30000
heap
page read and write
2FA0000
trusted library allocation
page read and write
45E0000
direct allocation
page read and write
4440000
direct allocation
page read and write
433C000
heap
page read and write
2A35000
trusted library allocation
page execute and read and write
31F6000
trusted library allocation
page read and write
3E27000
heap
page read and write
3122000
trusted library allocation
page read and write
2F7F000
trusted library allocation
page read and write
67D8000
trusted library allocation
page read and write
591E000
stack
page read and write
3082000
trusted library allocation
page read and write
3108000
trusted library allocation
page read and write
2E96000
trusted library allocation
page read and write
312F000
trusted library allocation
page read and write
67E0000
trusted library allocation
page read and write
2FB5000
trusted library allocation
page read and write
3E49000
heap
page read and write
3213000
trusted library allocation
page read and write
27AE000
stack
page read and write
592A000
trusted library allocation
page read and write
666E000
stack
page read and write
4440000
direct allocation
page read and write
490000
unkown
page write copy
470D000
direct allocation
page read and write
8FA000
stack
page read and write
426000
system
page execute and read and write
2A37000
trusted library allocation
page execute and read and write
2F96000
trusted library allocation
page read and write
3110000
trusted library allocation
page read and write
DF5000
heap
page read and write
3200000
trusted library allocation
page read and write
64AE000
stack
page read and write
5696000
heap
page read and write
2CAE000
stack
page read and write
45E0000
direct allocation
page read and write
2EAA000
trusted library allocation
page read and write
A4A000
heap
page read and write
4709000
direct allocation
page read and write
30AF000
trusted library allocation
page read and write
C60000
heap
page read and write
45E0000
direct allocation
page read and write
3209000
trusted library allocation
page read and write
291A000
trusted library allocation
page execute and read and write
8AF000
stack
page read and write
4440000
direct allocation
page read and write
2AA0000
trusted library allocation
page execute and read and write
30C0000
trusted library allocation
page read and write
100000
heap
page read and write
4563000
direct allocation
page read and write
53B0000
trusted library allocation
page execute and read and write
68C0000
trusted library allocation
page execute and read and write
3067000
trusted library allocation
page read and write
A7D000
heap
page read and write
4AB000
unkown
page readonly
2FAB000
trusted library allocation
page read and write
2EB1000
trusted library allocation
page read and write
470D000
direct allocation
page read and write
2F64000
trusted library allocation
page read and write
314A000
trusted library allocation
page read and write
28FD000
trusted library allocation
page execute and read and write
31EB000
trusted library allocation
page read and write
646E000
stack
page read and write
477E000
direct allocation
page read and write
27B0000
heap
page read and write
3DD1000
heap
page read and write
2BA0000
heap
page read and write
2F57000
trusted library allocation
page read and write
3062000
trusted library allocation
page read and write
2A30000
trusted library allocation
page read and write
54E0000
heap
page read and write
67F0000
trusted library allocation
page read and write
3E6F000
heap
page read and write
2F51000
trusted library allocation
page read and write
401E000
trusted library allocation
page read and write
320E000
trusted library allocation
page read and write
470D000
direct allocation
page read and write
2FA4000
trusted library allocation
page read and write
28F3000
trusted library allocation
page execute and read and write
2920000
heap
page read and write
A72000
heap
page read and write
3F31000
heap
page read and write
316A000
trusted library allocation
page read and write
3C30000
heap
page read and write
2F8B000
trusted library allocation
page read and write
8FE000
stack
page read and write
D7D000
heap
page read and write
67C0000
trusted library allocation
page read and write
3242000
trusted library allocation
page read and write
3178000
trusted library allocation
page read and write
DF0000
heap
page read and write
2F87000
trusted library allocation
page read and write
A4E000
heap
page read and write
2A9E000
stack
page read and write
477E000
direct allocation
page read and write
There are 282 hidden memdumps, click here to show them.