Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

QUOTATION#09678.exe

PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows

initial sample

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_QUOTATION#09678._f7e8cda497f49dbb58f08b576154eda73825fe_24f8ed17_c8c4fc4d-e9f8-4af6-abaf-2ae8e4f23469\Report.wer

Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9462.tmp.dmp

Mini DuMP crash report, 16 streams, Fri Nov 1 07:36:59 2024, 0x1205a4 type

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9703.tmp.WERInternalMetadata.xml

XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators

dropped

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9742.tmp.xml

XML 1.0 document, ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\installutil.exe.log

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

data

dropped

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1xpgwqxv.fvz.psm1

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cl0uf5e1.v3l.ps1

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rgvd3sxk.ceb.ps1

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yof40a4m.tmj.psm1

ASCII text, with no line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmp121E.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp121F.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp1240.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp1241.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp1261.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp1262.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmp24F6.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmp2506.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmp2517.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmp2527.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmp2548.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmp2558.tmp

SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp49EE.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp49FE.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp4A0F.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp4A20.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp4A40.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp5A83.tmp

dropped

C:\Users\user\AppData\Local\Temp\tmp814F.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp817E.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmp819F.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpB87F.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpB88F.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpB8AF.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpB8B0.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3

dropped

C:\Users\user\AppData\Local\Temp\tmpB8D1.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpB8D2.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpB94F.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpB950.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpB960.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpB961.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpB962.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpB963.tmp

ASCII text, with very long lines (1024), with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpEEE6.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpEEE7.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpEEF8.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpEEF9.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1

dropped

C:\Users\user\AppData\Local\Temp\tmpEF0A.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmpEF1A.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmpEF2B.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmpEF3C.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmpEF4C.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmpEF4D.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Users\user\AppData\Local\Temp\tmpEF5E.tmp

SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8

dropped

C:\Windows\appcompat\Programs\Amcache.hve

MS Windows registry file, NT/2000 or above

dropped

There are 46 hidden files, click here to show them.

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\QUOTATION#09678.exe

"C:\Users\user\Desktop\QUOTATION#09678.exe"

Details

Is windows:	false
Is dropped:	false
PID:	764
Target ID:	0
Parent PID:	1028
Name:	QUOTATION#09678.exe
Path:	C:\Users\user\Desktop\QUOTATION#09678.exe
Commandline:	"C:\Users\user\Desktop\QUOTATION#09678.exe"
Size:	2789519
MD5:	4E5909728A72EB29F5CF1FE01867C982
Time:	03:36:55
Date:	01/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x2ccfea00000
Modulesize:	98304
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Yara detected UAC Bypass using CMSTP	Exploits
Adds a directory exclusion to Windows Defender	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Initial sample is a PE file and has a suspicious name	System Summary
Machine Learning detection for sample	AV Detection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
PE file does not import any functions	System Summary
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: Powershell Defender Exclusion	System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force

Details

Is windows:	true
Is dropped:	false
PID:	3992
Target ID:	3
Parent PID:	764
Name:	powershell.exe
Class:	powershell
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\QUOTATION#09678.exe" -Force
Size:	452608
MD5:	04029E121A0CFA5991749937DD22A1D9
Time:	03:36:57
Date:	01/11/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7be880000
Modulesize:	462848
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Adds a directory exclusion to Windows Defender	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Powershell Defender Exclusion	System Summary
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"

Details

Is windows:	true
Is dropped:	false
PID:	5652
Target ID:	5
Parent PID:	764
Name:	InstallUtil.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Size:	42064
MD5:	5D4073B2EB6D217C19F2B22F21BF8D57
Time:	03:36:57
Date:	01/11/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true
Modulebase:	0xd80000
Modulesize:	49152
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"

Details

Is windows:	true
Is dropped:	false
PID:	3712
Target ID:	7
Parent PID:	764
Name:	InstallUtil.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
Size:	42064
MD5:	5D4073B2EB6D217C19F2B22F21BF8D57
Time:	03:36:57
Date:	01/11/2024
Reason:	newprocess
Reputation:	moderate
Is admin:	true
Is elevated:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Allocates memory in foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	6008
Target ID:	1
Parent PID:	764
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	03:36:55
Date:	01/11/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6d64d0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	6656
Target ID:	4
Parent PID:	3992
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	03:36:57
Date:	01/11/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6d64d0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	1520
Target ID:	6
Parent PID:	5652
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	03:36:57
Date:	01/11/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6d64d0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

C:\Windows\System32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 764 -s 1056

Details

Is windows:	true
Is dropped:	false
PID:	3808
Target ID:	10
Parent PID:	764
Name:	WerFault.exe
Path:	C:\Windows\System32\WerFault.exe
Commandline:	C:\Windows\system32\WerFault.exe -u -p 764 -s 1056
Size:	570736
MD5:	FD27D9F6D02763BDE32511B5DF7FF7A0
Time:	03:36:58
Date:	01/11/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff6032e0000
Modulesize:	581632
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
One or more processes crash	System Summary
Spawns processes	System Summary	Process Injection

C:\Windows\System32\wbem\WmiPrvSE.exe

C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

Details

Is windows:	true
Is dropped:	false
PID:	7064
Target ID:	12
Parent PID:	752
Name:	WmiPrvSE.exe
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Size:	496640
MD5:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Time:	03:37:02
Date:	01/11/2024
Reason:	newprocess
Reputation:	high
Is admin:	false
Is elevated:	true
Modulebase:	0x7ff6ef0c0000
Modulesize:	516096
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://ipinfo.io/ip%appdata%

unknown

94.141.120.6:55123

https://api.ipify.orgcookies//settinString.Removeg

unknown

http://94.141.120.6:55123/

94.141.120.6

https://duckduckgo.com/chrome_newtab

unknown

https://duckduckgo.com/ac/?q=

unknown

https://www.google.com/images/branding/product/ico/googleg_lodp.ico

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous

unknown

http://tempuri.org/Endpoint/CheckConnectResponse

unknown

http://schemas.datacontract.org/2004/07/

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX

unknown

http://tempuri.org/Endpoint/EnvironmentSettings

unknown

https://api.ip.sb/geoip%USERPEnvironmentROFILE%

unknown

https://api.ip.sb

unknown

https://api.ip.sb/geoip

unknown

http://schemas.xmlsoap.org/soap/envelope/

unknown

https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=

unknown

http://tempuri.org/

unknown

http://upx.sf.net

unknown

http://tempuri.org/Endpoint/CheckConnect

unknown

https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=

unknown

https://www.ecosia.org/newtab/

unknown

http://tempuri.org/Endpoint/VerifyUpdateResponse

unknown

http://tempuri.org/Endpoint/SetEnvironment

unknown

http://tempuri.org/Endpoint/SetEnvironmentResponse

unknown

http://tempuri.org/Endpoint/GetUpdates

unknown

https://ac.ecosia.org/autocomplete?q=

unknown

http://94.141.120.6:55123t-

unknown

http://94.141.120.6:55123

unknown

http://schemas.xmlsoap.org/ws/2004/08/addressing

unknown

http://tempuri.org/Endpoint/GetUpdatesResponse

unknown

https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search

unknown

http://tempuri.org/Endpoint/EnvironmentSettingsResponse

unknown

http://tempuri.org/Endpoint/VerifyUpdate

unknown

http://tempuri.org/0

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=

unknown

http://schemas.xmlsoap.org/soap/actor/next

unknown

There are 28 hidden URLs, click here to show them.

Domains

Name

Malicious

api.ip.sb

unknown

IPs

Domain

Country

Malicious

94.141.120.6

unknown

Russian Federation

Details

IP:	94.141.120.6
TargetID:	5
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Country:	Russian Federation
Countrycode:	RUS
ASN number:	43429
ASN name:	UNITLINE_RST_NET1RostovnaDonuRU
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
HTTP GET or POST without a user agent	Networking
Connects to IPs without corresponding DNS lookups	Networking
Posts data to webserver	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System

EnableLUA

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance

Enabled

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\installutil_RASMANCS

FileDirectory

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

ProgramId

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

FileId

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

LowerCaseLongPath

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

LongPathHash

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

Name

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

OriginalFileName

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

Publisher

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

Version

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

BinFileVersion

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

BinaryType

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

ProductName

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

ProductVersion

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

LinkDate

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

BinProductVersion

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

AppxPackageFullName

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

AppxPackageRelativeId

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

Size

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

Language

\REGISTRY\A\{527ba53f-917c-be3e-7f12-da424c84e111}\Root\InventoryApplicationFile\quotation#09678.|7deefcb8c54731d

Usn

There are 26 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

402000

remote allocation

page execute and read and write

2CC91C21000

trusted library allocation

page read and write

2CC81774000

trusted library allocation

page read and write

5F19000

trusted library allocation

page read and write

175C000

stack

page read and write

7FF848F36000

trusted library allocation

page read and write

69F5000

trusted library allocation

page read and write

5A8A000

trusted library allocation

page read and write

6A20000

trusted library allocation

page read and write

5B40000

trusted library allocation

page execute and read and write

33DA000

trusted library allocation

page read and write

7FF848DE0000

trusted library allocation

page read and write

5C5E000

trusted library allocation

page read and write

703B000

stack

page read and write

66A2000

heap

page read and write

45A8000

trusted library allocation

page read and write

7FF848D4B000

trusted library allocation

page read and write

1138000

stack

page read and write

34C4000

trusted library allocation

page read and write

2CC91411000

trusted library allocation

page read and write

5F35000

trusted library allocation

page read and write

76D1000

heap

page read and write

458F000

trusted library allocation

page read and write

7FF848D47000

trusted library allocation

page read and write

7A90000

heap

page read and write

7A10000

trusted library allocation

page execute and read and write

68C5000

trusted library allocation

page read and write

5AFE000

stack

page read and write

45C0000

trusted library allocation

page read and write

6738000

heap

page read and write

400000

remote allocation

page execute and read and write

7FF848F10000

trusted library allocation

page read and write

5F15000

trusted library allocation

page read and write

2CCFEB41000

heap

page read and write

2CCFECD0000

heap

page read and write

2CCFEB0C000

heap

page read and write

304E000

stack

page read and write

7FF848D34000

trusted library allocation

page read and write

5951000

trusted library allocation

page read and write

335B000

trusted library allocation

page read and write

406D000

trusted library allocation

page read and write

2CCFEAB0000

heap

page read and write

1250000

heap

page read and write

1770000

trusted library allocation

page read and write

667C000

heap

page read and write

30ED000

trusted library allocation

page read and write

17AA000

heap

page read and write

D93C1FE000

stack

page read and write

15B0000

trusted library allocation

page read and write

D93CBFD000

stack

page read and write

2CCFF0F3000

trusted library allocation

page read and write

6CC0000

trusted library allocation

page read and write

2CCFEB2A000

heap

page read and write

45AD000

trusted library allocation

page read and write

7050000

trusted library allocation

page execute and read and write

5F3F000

trusted library allocation

page read and write

4595000

trusted library allocation

page read and write

4061000

trusted library allocation

page read and write

40D3000

trusted library allocation

page read and write

69E1000

trusted library allocation

page read and write

69E8000

trusted library allocation

page read and write

59A0000

trusted library allocation

page read and write

179A000

trusted library allocation

page read and write

4294000

trusted library allocation

page read and write

59B0000

trusted library allocation

page read and write

841F000

stack

page read and write

675E000

heap

page read and write

17AE000

heap

page read and write

56BE000

stack

page read and write

69D8000

trusted library allocation

page read and write

66E2000

heap

page read and write

3061000

trusted library allocation

page read and write

1387000

heap

page read and write

6A10000

trusted library allocation

page execute and read and write

7FF848D3D000

trusted library allocation

page execute and read and write

7140000

trusted library allocation

page read and write

D93C4FD000

stack

page read and write

69E6000

trusted library allocation

page read and write

694D000

stack

page read and write

1610000

heap

page read and write

5990000

trusted library allocation

page read and write

7FF848ED0000

trusted library allocation

page read and write

79D0000

trusted library allocation

page read and write

32B2000

trusted library allocation

page read and write

7EFF0000

trusted library allocation

page execute and read and write

6726000

heap

page read and write

7FF44C4E0000

trusted library allocation

page execute and read and write

6EE0000

heap

page read and write

1597000

trusted library allocation

page execute and read and write

3324000

trusted library allocation

page read and write

32F3000

trusted library allocation

page read and write

5AB0000

trusted library allocation

page execute and read and write

6CF0000

trusted library allocation

page execute and read and write

5A70000

trusted library allocation

page read and write

68D0000

trusted library allocation

page read and write

51FD000

stack

page read and write

7FF848F40000

trusted library allocation

page read and write

69C2000

trusted library allocation

page read and write

45AB000

trusted library allocation

page read and write

2CCFEB6F000

heap

page read and write

33A1000

trusted library allocation

page read and write

7FF848D8C000

trusted library allocation

page execute and read and write

6E9D000

stack

page read and write

12C7000

heap

page read and write

66D0000

heap

page read and write

1586000

trusted library allocation

page execute and read and write

34A2000

trusted library allocation

page read and write

698F000

stack

page read and write

2CCFF0C0000

trusted library allocation

page read and write

1570000

trusted library allocation

page read and write

459F000

trusted library allocation

page read and write

7FF848F0E000

trusted library allocation

page read and write

69A0000

trusted library allocation

page read and write

33AF000

trusted library allocation

page read and write

30E0000

trusted library allocation

page read and write

5960000

trusted library allocation

page read and write

5A90000

trusted library allocation

page read and write

567E000

stack

page read and write

1582000

trusted library allocation

page read and write

76FC000

heap

page read and write

1595000

trusted library allocation

page execute and read and write

7FF848F20000

trusted library allocation

page execute and read and write

2CCFF1E0000

heap

page read and write

56D0000

heap

page execute and read and write

56C0000

trusted library allocation

page read and write

7FF848EE9000

trusted library allocation

page read and write

2CCFF0F0000

trusted library allocation

page read and write

2CC91417000

trusted library allocation

page read and write

69C6000

trusted library allocation

page read and write

3241000

trusted library allocation

page read and write

30B0000

trusted library allocation

page read and write

155F000

stack

page read and write

7FF848D30000

trusted library allocation

page read and write

591E000

stack

page read and write

103B000

stack

page read and write

5C5B000

trusted library allocation

page read and write

773F000

heap

page read and write

6A70000

trusted library allocation

page read and write

17A0000

heap

page read and write

7FF848D42000

trusted library allocation

page read and write

5EF2000

trusted library allocation

page read and write

76C4000

heap

page read and write

5ED0000

trusted library allocation

page read and write

156D000

trusted library allocation

page execute and read and write

35A5000

trusted library allocation

page read and write

69CC000

trusted library allocation

page read and write

7712000

heap

page read and write

1290000

heap

page read and write

7C1E000

stack

page read and write

3615000

trusted library allocation

page read and write

5F2F000

trusted library allocation

page read and write

2CCFFB90000

heap

page execute and read and write

2CCFEAA0000

heap

page read and write

45B3000

trusted library allocation

page read and write

5942000

trusted library allocation

page read and write

76F3000

heap

page read and write

1790000

trusted library allocation

page read and write

3677000

trusted library allocation

page read and write

35D6000

trusted library allocation

page read and write

7FF848D4D000

trusted library allocation

page execute and read and write

7FF848D54000

trusted library allocation

page read and write

349C000

trusted library allocation

page read and write

31E4000

trusted library allocation

page read and write

5AA0000

trusted library allocation

page read and write

2CC81485000

trusted library allocation

page read and write

5F00000

trusted library allocation

page execute and read and write

341A000

trusted library allocation

page read and write

1794000

trusted library allocation

page read and write

69F2000

trusted library allocation

page read and write

2CCFEB00000

heap

page read and write

6A80000

trusted library allocation

page read and write

2CCFFA30000

heap

page read and write

2CC81411000

trusted library allocation

page read and write

5A60000

trusted library allocation

page read and write

671B000

heap

page read and write

1760000

trusted library allocation

page read and write

42B4000

trusted library allocation

page read and write

5A10000

trusted library allocation

page execute and read and write

6A30000

trusted library allocation

page read and write

665E000

stack

page read and write

6760000

trusted library allocation

page read and write

12AE000

heap

page read and write

1564000

trusted library allocation

page read and write

57DE000

stack

page read and write

31EC000

trusted library allocation

page read and write

3364000

trusted library allocation

page read and write

2CCFF0E0000

trusted library allocation

page read and write

1580000

trusted library allocation

page read and write

5920000

trusted library allocation

page read and write

2CCFEA02000

unkown

page readonly

7FF848D32000

trusted library allocation

page read and write

7FF848F00000

trusted library allocation

page read and write

69ED000

trusted library allocation

page read and write

2CCFF220000

trusted library allocation

page read and write

68E0000

heap

page execute and read and write

4072000

trusted library allocation

page read and write

2CC91EA2000

trusted library allocation

page read and write

2CCFEAD0000

heap

page read and write

79BE000

stack

page read and write

D93C0FF000

stack

page read and write

3281000

trusted library allocation

page read and write

7040000

trusted library allocation

page read and write

2CCFEAD5000

heap

page read and write

D93C2FE000

stack

page read and write

2CCFEA09000

unkown

page readonly

5A8D000

trusted library allocation

page read and write

67BE000

stack

page read and write

6C9E000

stack

page read and write

6CB0000

trusted library allocation

page read and write

1298000

heap

page read and write

3411000

trusted library allocation

page read and write

6EDE000

stack

page read and write

3397000

trusted library allocation

page read and write

6764000

trusted library allocation

page read and write

7749000

heap

page read and write

5A00000

trusted library allocation

page read and write

5F12000

trusted library allocation

page read and write

672A000

heap

page read and write

5EF0000

trusted library allocation

page read and write

68BE000

stack

page read and write

7BDE000

stack

page read and write

D93C6FE000

stack

page read and write

9136000

heap

page read and write

15FE000

stack

page read and write

17A6000

heap

page read and write

34FE000

trusted library allocation

page read and write

59E0000

trusted library allocation

page execute and read and write

7FF848F30000

trusted library allocation

page read and write

7FF848E50000

trusted library allocation

page execute and read and write

7150000

trusted library allocation

page read and write

3486000

trusted library allocation

page read and write

69DE000

trusted library allocation

page read and write

592B000

trusted library allocation

page read and write

D93C8FE000

stack

page read and write

7FF848D5D000

trusted library allocation

page execute and read and write

59F0000

trusted library allocation

page read and write

5936000

trusted library allocation

page read and write

2CCFFA84000

heap

page read and write

7FF848D50000

trusted library allocation

page read and write

5931000

trusted library allocation

page read and write

1780000

heap

page execute and read and write

4194000

trusted library allocation

page read and write

7FF848D40000

trusted library allocation

page read and write

2CC81497000

trusted library allocation

page read and write

6744000

heap

page read and write

56D3000

heap

page execute and read and write

1560000

trusted library allocation

page read and write

11E5000

heap

page read and write

33B5000

trusted library allocation

page read and write

557E000

stack

page read and write

776F000

heap

page read and write

2CC81448000

trusted library allocation

page read and write

D93C3FE000

stack

page read and write

2CCFEB74000

heap

page read and write

11CE000

stack

page read and write

5971000

trusted library allocation

page read and write

69B0000

trusted library allocation

page read and write

68C0000

trusted library allocation

page read and write

1592000

trusted library allocation

page read and write

122E000

stack

page read and write

7708000

heap

page read and write

69CF000

trusted library allocation

page read and write

1600000

trusted library allocation

page execute and read and write

7170000

heap

page read and write

6EF0000

heap

page read and write

342D000

trusted library allocation

page read and write

2CCFEB6C000

heap

page read and write

7FF848D5B000

trusted library allocation

page execute and read and write

7721000

heap

page read and write

3050000

heap

page read and write

31EA000

trusted library allocation

page read and write

2CCFF130000

heap

page execute and read and write

7FF848F1D000

trusted library allocation

page read and write

157D000

trusted library allocation

page execute and read and write

7FF848EF0000

trusted library allocation

page read and write

5F3A000

trusted library allocation

page read and write

11D0000

heap

page read and write

1280000

trusted library allocation

page read and write

159B000

trusted library allocation

page execute and read and write

30D9000

trusted library allocation

page read and write

344F000

trusted library allocation

page read and write

359C000

trusted library allocation

page read and write

6714000

heap

page read and write

5C50000

trusted library allocation

page read and write

2CCFEA16000

unkown

page readonly

76C0000

heap

page read and write

3206000

trusted library allocation

page read and write

594E000

trusted library allocation

page read and write

5F2A000

trusted library allocation

page read and write

32E9000

trusted library allocation

page read and write

7FF848E16000

trusted library allocation

page execute and read and write

2CCFEAE0000

heap

page read and write

7759000

heap

page read and write

69C4000

trusted library allocation

page read and write

7160000

trusted library allocation

page execute and read and write

5C4F000

stack

page read and write

76D8000

heap

page read and write

1590000

trusted library allocation

page read and write

5F10000

trusted library allocation

page read and write

30CE000

trusted library allocation

page read and write

2CCFEA06000

unkown

page readonly

3659000

trusted library allocation

page read and write

3427000

trusted library allocation

page read and write

9120000

heap

page read and write

D93CDFB000

stack

page read and write

7FF848DF0000

trusted library allocation

page execute and read and write

6770000

trusted library allocation

page execute and read and write

2CCFEEA5000

heap

page read and write

30F1000

trusted library allocation

page read and write

7180000

trusted library allocation

page read and write

581D000

stack

page read and write

6A00000

trusted library allocation

page read and write

1338000

heap

page read and write

5068000

trusted library allocation

page read and write

7FF848DE6000

trusted library allocation

page read and write

1180000

heap

page read and write

7FF848EE0000

trusted library allocation

page read and write

D93CCFE000

stack

page read and write

11E0000

heap

page read and write

2CCFEA00000

unkown

page readonly

7729000

heap

page read and write

6A60000

heap

page read and write

6CA0000

trusted library allocation

page execute and read and write

79C0000

trusted library allocation

page execute and read and write

2CCFFC40000

heap

page read and write

1563000

trusted library allocation

page execute and read and write

5B3E000

stack

page read and write

2CCFEEA0000

heap

page read and write

6668000

heap

page read and write

171E000

stack

page read and write

348F000

trusted library allocation

page read and write

5F28000

trusted library allocation

page read and write

D93C7FE000

stack

page read and write

69D4000

trusted library allocation

page read and write

6754000

heap

page read and write

7FF848D33000

trusted library allocation

page execute and read and write

6CE0000

trusted library allocation

page read and write

D93BD52000

stack

page read and write

7FF848DEC000

trusted library allocation

page execute and read and write

31DE000

trusted library allocation

page read and write

68C2000

trusted library allocation

page read and write

459C000

trusted library allocation

page read and write

45A5000

trusted library allocation

page read and write

3277000

trusted library allocation

page read and write

2CCFF140000

trusted library section

page read and write

There are 335 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
QUOTATION#09678.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportQUOTATION#09678.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
QUOTATION#09678.exe