Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
|
"C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe"
|
|
|
|
C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe
|
"C:\Users\user\Desktop\MV BUSAN STAR - calling to discharge about 55,000Mt of aggregates.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://api.ipify.org/
|
104.26.13.205
|
||
|
https://api.ipify.org
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
https://api.ipify.org/t
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://tempuri.org/project_mgtDataSet.xsdOproject_mgt_system.Properties.Resources
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
api.ipify.org
|
104.26.13.205
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
104.26.13.205
|
api.ipify.org
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
3EA9000
|
trusted library allocation
|
page read and write
|
|
|
|
402000
|
remote allocation
|
page execute and read and write
|
|
|
|
12CE000
|
stack
|
page read and write
|
||
|
2BFB000
|
trusted library allocation
|
page execute and read and write
|
||
|
118E000
|
stack
|
page read and write
|
||
|
143A000
|
trusted library allocation
|
page execute and read and write
|
||
|
6B30000
|
trusted library allocation
|
page execute and read and write
|
||
|
1430000
|
trusted library allocation
|
page read and write
|
||
|
5312000
|
trusted library allocation
|
page read and write
|
||
|
58EE000
|
stack
|
page read and write
|
||
|
611E000
|
stack
|
page read and write
|
||
|
52EB000
|
trusted library allocation
|
page read and write
|
||
|
5453000
|
heap
|
page read and write
|
||
|
5311000
|
trusted library allocation
|
page read and write
|
||
|
1092000
|
heap
|
page read and write
|
||
|
748E000
|
stack
|
page read and write
|
||
|
3EB9000
|
trusted library allocation
|
page read and write
|
||
|
8FFF000
|
stack
|
page read and write
|
||
|
105E000
|
heap
|
page read and write
|
||
|
1510000
|
trusted library allocation
|
page read and write
|
||
|
A80000
|
unkown
|
page readonly
|
||
|
5316000
|
trusted library allocation
|
page read and write
|
||
|
2BE6000
|
trusted library allocation
|
page execute and read and write
|
||
|
6ABC000
|
trusted library allocation
|
page read and write
|
||
|
5340000
|
trusted library allocation
|
page read and write
|
||
|
1440000
|
trusted library allocation
|
page read and write
|
||
|
2BD0000
|
trusted library allocation
|
page read and write
|
||
|
52FB000
|
trusted library allocation
|
page read and write
|
||
|
2BE0000
|
trusted library allocation
|
page read and write
|
||
|
7490000
|
trusted library allocation
|
page execute and read and write
|
||
|
1420000
|
trusted library allocation
|
page read and write
|
||
|
3F1D000
|
trusted library allocation
|
page read and write
|
||
|
8E80000
|
trusted library section
|
page read and write
|
||
|
73FE000
|
stack
|
page read and write
|
||
|
53A0000
|
trusted library allocation
|
page read and write
|
||
|
5FC0000
|
heap
|
page read and write
|
||
|
6A9E000
|
stack
|
page read and write
|
||
|
5306000
|
trusted library allocation
|
page read and write
|
||
|
F60000
|
heap
|
page read and write
|
||
|
1077000
|
heap
|
page read and write
|
||
|
B26000
|
unkown
|
page readonly
|
||
|
2E3E000
|
stack
|
page read and write
|
||
|
14EC000
|
stack
|
page read and write
|
||
|
72FE000
|
stack
|
page read and write
|
||
|
EF8000
|
stack
|
page read and write
|
||
|
2F15000
|
trusted library allocation
|
page read and write
|
||
|
B6FE000
|
stack
|
page read and write
|
||
|
1423000
|
trusted library allocation
|
page read and write
|
||
|
2F01000
|
trusted library allocation
|
page read and write
|
||
|
2D90000
|
heap
|
page execute and read and write
|
||
|
601F000
|
stack
|
page read and write
|
||
|
1165000
|
heap
|
page read and write
|
||
|
6885000
|
heap
|
page read and write
|
||
|
1124000
|
trusted library allocation
|
page read and write
|
||
|
5301000
|
trusted library allocation
|
page read and write
|
||
|
52FE000
|
trusted library allocation
|
page read and write
|
||
|
1527000
|
heap
|
page read and write
|
||
|
2CD8000
|
trusted library allocation
|
page read and write
|
||
|
BD9000
|
stack
|
page read and write
|
||
|
2BF7000
|
trusted library allocation
|
page execute and read and write
|
||
|
56A0000
|
heap
|
page read and write
|
||
|
530A000
|
trusted library allocation
|
page read and write
|
||
|
1436000
|
trusted library allocation
|
page execute and read and write
|
||
|
2EB1000
|
trusted library allocation
|
page read and write
|
||
|
5450000
|
heap
|
page read and write
|
||
|
2E80000
|
trusted library allocation
|
page read and write
|
||
|
65DD000
|
stack
|
page read and write
|
||
|
5320000
|
trusted library allocation
|
page read and write
|
||
|
1447000
|
trusted library allocation
|
page execute and read and write
|
||
|
68C7000
|
heap
|
page read and write
|
||
|
144B000
|
trusted library allocation
|
page execute and read and write
|
||
|
1138000
|
heap
|
page read and write
|
||
|
5FD0000
|
heap
|
page read and write
|
||
|
2BF0000
|
trusted library allocation
|
page read and write
|
||
|
3EB1000
|
trusted library allocation
|
page read and write
|
||
|
68EE000
|
heap
|
page read and write
|
||
|
2EFD000
|
trusted library allocation
|
page read and write
|
||
|
F67000
|
heap
|
page read and write
|
||
|
2EE7000
|
trusted library allocation
|
page read and write
|
||
|
2F26000
|
trusted library allocation
|
page read and write
|
||
|
53C0000
|
heap
|
page read and write
|
||
|
2BF5000
|
trusted library allocation
|
page execute and read and write
|
||
|
6940000
|
heap
|
page read and write
|
||
|
576E000
|
stack
|
page read and write
|
||
|
53F0000
|
heap
|
page read and write
|
||
|
586E000
|
stack
|
page read and write
|
||
|
BF0000
|
heap
|
page read and write
|
||
|
6840000
|
heap
|
page read and write
|
||
|
54E0000
|
heap
|
page execute and read and write
|
||
|
BBA000
|
stack
|
page read and write
|
||
|
59E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2C5E000
|
stack
|
page read and write
|
||
|
2E9E000
|
stack
|
page read and write
|
||
|
5334000
|
trusted library allocation
|
page read and write
|
||
|
114E000
|
heap
|
page read and write
|
||
|
1413000
|
trusted library allocation
|
page execute and read and write
|
||
|
2EF1000
|
trusted library allocation
|
page read and write
|
||
|
1050000
|
heap
|
page read and write
|
||
|
11BF000
|
heap
|
page read and write
|
||
|
6850000
|
heap
|
page read and write
|
||
|
2D00000
|
heap
|
page read and write
|
||
|
11BC000
|
heap
|
page read and write
|
||
|
2BE2000
|
trusted library allocation
|
page read and write
|
||
|
3EA1000
|
trusted library allocation
|
page read and write
|
||
|
F40000
|
heap
|
page read and write
|
||
|
1130000
|
heap
|
page read and write
|
||
|
6B20000
|
heap
|
page read and write
|
||
|
13CF000
|
stack
|
page read and write
|
||
|
645E000
|
stack
|
page read and write
|
||
|
2E7C000
|
stack
|
page read and write
|
||
|
56B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
635E000
|
stack
|
page read and write
|
||
|
6958000
|
trusted library allocation
|
page read and write
|
||
|
5400000
|
trusted library allocation
|
page read and write
|
||
|
6B00000
|
trusted library allocation
|
page read and write
|
||
|
52E4000
|
trusted library allocation
|
page read and write
|
||
|
572C000
|
stack
|
page read and write
|
||
|
1010000
|
heap
|
page read and write
|
||
|
1206000
|
heap
|
page read and write
|
||
|
2D80000
|
trusted library allocation
|
page read and write
|
||
|
F30000
|
heap
|
page read and write
|
||
|
70C0000
|
heap
|
page read and write
|
||
|
108F000
|
heap
|
page read and write
|
||
|
71E0000
|
heap
|
page read and write
|
||
|
59F0000
|
trusted library allocation
|
page read and write
|
||
|
2EEF000
|
trusted library allocation
|
page read and write
|
||
|
2C10000
|
trusted library allocation
|
page read and write
|
||
|
11AD000
|
heap
|
page read and write
|
||
|
671E000
|
stack
|
page read and write
|
||
|
1520000
|
heap
|
page read and write
|
||
|
142D000
|
trusted library allocation
|
page execute and read and write
|
||
|
52F0000
|
trusted library allocation
|
page read and write
|
||
|
58CE000
|
stack
|
page read and write
|
||
|
52E0000
|
trusted library allocation
|
page read and write
|
||
|
B73E000
|
stack
|
page read and write
|
||
|
F50000
|
heap
|
page read and write
|
||
|
5690000
|
heap
|
page read and write
|
||
|
121D000
|
heap
|
page read and write
|
||
|
1020000
|
heap
|
page read and write
|
||
|
4F9C000
|
stack
|
page read and write
|
||
|
6AB0000
|
trusted library allocation
|
page read and write
|
||
|
2D30000
|
heap
|
page read and write
|
||
|
5920000
|
trusted library allocation
|
page read and write
|
||
|
77C2000
|
trusted library allocation
|
page read and write
|
||
|
6BE0000
|
trusted library allocation
|
page execute and read and write
|
||
|
530E000
|
trusted library allocation
|
page read and write
|
||
|
13D0000
|
heap
|
page read and write
|
||
|
2BEA000
|
trusted library allocation
|
page execute and read and write
|
||
|
5940000
|
heap
|
page read and write
|
||
|
2F20000
|
trusted library allocation
|
page read and write
|
||
|
6BA0000
|
heap
|
page read and write
|
||
|
1123000
|
trusted library allocation
|
page execute and read and write
|
||
|
5945000
|
heap
|
page read and write
|
||
|
53B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
55F0000
|
trusted library section
|
page readonly
|
||
|
F96000
|
heap
|
page read and write
|
||
|
5330000
|
trusted library allocation
|
page read and write
|
||
|
6AD0000
|
trusted library allocation
|
page read and write
|
||
|
58AE000
|
stack
|
page read and write
|
||
|
6ADA000
|
trusted library allocation
|
page read and write
|
||
|
5390000
|
heap
|
page read and write
|
||
|
7430000
|
trusted library allocation
|
page read and write
|
||
|
7440000
|
trusted library allocation
|
page read and write
|
||
|
128E000
|
stack
|
page read and write
|
||
|
1460000
|
trusted library allocation
|
page read and write
|
||
|
8E5E000
|
stack
|
page read and write
|
||
|
B97E000
|
stack
|
page read and write
|
||
|
10F6000
|
heap
|
page read and write
|
||
|
112D000
|
trusted library allocation
|
page execute and read and write
|
||
|
F90000
|
heap
|
page read and write
|
||
|
659E000
|
stack
|
page read and write
|
||
|
52FE000
|
trusted library allocation
|
page read and write
|
||
|
11D0000
|
heap
|
page read and write
|
||
|
3ED9000
|
trusted library allocation
|
page read and write
|
||
|
68E7000
|
heap
|
page read and write
|
||
|
7208000
|
heap
|
page read and write
|
||
|
5FFA000
|
heap
|
page read and write
|
||
|
2EA1000
|
trusted library allocation
|
page read and write
|
||
|
141D000
|
trusted library allocation
|
page execute and read and write
|
||
|
5350000
|
trusted library allocation
|
page read and write
|
||
|
1400000
|
trusted library allocation
|
page read and write
|
||
|
6AE0000
|
trusted library allocation
|
page read and write
|
||
|
A82000
|
unkown
|
page readonly
|
||
|
6AF0000
|
trusted library allocation
|
page execute and read and write
|
||
|
105B000
|
heap
|
page read and write
|
||
|
B83F000
|
stack
|
page read and write
|
||
|
2F1E000
|
trusted library allocation
|
page read and write
|
||
|
2D70000
|
trusted library allocation
|
page read and write
|
||
|
681E000
|
stack
|
page read and write
|
||
|
4FAD000
|
stack
|
page read and write
|
||
|
8E10000
|
trusted library allocation
|
page execute and read and write
|
||
|
2F24000
|
trusted library allocation
|
page read and write
|
||
|
53E0000
|
trusted library allocation
|
page read and write
|
||
|
1442000
|
trusted library allocation
|
page read and write
|
||
|
544B000
|
stack
|
page read and write
|
||
|
2E90000
|
trusted library allocation
|
page read and write
|
||
|
14F0000
|
trusted library allocation
|
page execute and read and write
|
||
|
66DE000
|
stack
|
page read and write
|
||
|
F80000
|
heap
|
page read and write
|
||
|
53A2000
|
trusted library allocation
|
page read and write
|
||
|
B87E000
|
stack
|
page read and write
|
||
|
5A00000
|
trusted library allocation
|
page read and write
|
||
|
531D000
|
trusted library allocation
|
page read and write
|
||
|
1110000
|
trusted library allocation
|
page read and write
|
||
|
400000
|
remote allocation
|
page execute and read and write
|
||
|
14AE000
|
stack
|
page read and write
|
||
|
EF7000
|
stack
|
page read and write
|
||
|
2D20000
|
trusted library allocation
|
page execute and read and write
|
||
|
699E000
|
stack
|
page read and write
|
||
|
1085000
|
heap
|
page read and write
|
||
|
6AC0000
|
trusted library allocation
|
page read and write
|
||
|
68DB000
|
heap
|
page read and write
|
||
|
53B0000
|
heap
|
page read and write
|
||
|
649D000
|
stack
|
page read and write
|
||
|
5325000
|
trusted library allocation
|
page read and write
|
||
|
2BF2000
|
trusted library allocation
|
page read and write
|
||
|
BF6000
|
heap
|
page read and write
|
||
|
530D000
|
trusted library allocation
|
page read and write
|
||
|
11B8000
|
heap
|
page read and write
|
||
|
1124000
|
heap
|
page read and write
|
||
|
1410000
|
trusted library allocation
|
page read and write
|
||
|
7446000
|
trusted library allocation
|
page read and write
|
||
|
1159000
|
heap
|
page read and write
|
||
|
539C000
|
stack
|
page read and write
|
||
|
5680000
|
heap
|
page execute and read and write
|
||
|
6950000
|
trusted library allocation
|
page read and write
|
||
|
52F6000
|
trusted library allocation
|
page read and write
|
||
|
5330000
|
trusted library allocation
|
page read and write
|
||
|
53B3000
|
heap
|
page read and write
|
||
|
5FF0000
|
heap
|
page read and write
|
||
|
1500000
|
heap
|
page read and write
|
||
|
1414000
|
trusted library allocation
|
page read and write
|
||
|
2EA0000
|
heap
|
page execute and read and write
|
||
|
2C68000
|
trusted library allocation
|
page read and write
|
||
|
1163000
|
heap
|
page read and write
|
||
|
1120000
|
trusted library allocation
|
page read and write
|
||
|
7F410000
|
trusted library allocation
|
page execute and read and write
|
||
|
5302000
|
trusted library allocation
|
page read and write
|
||
|
2F28000
|
trusted library allocation
|
page read and write
|
||
|
1432000
|
trusted library allocation
|
page read and write
|
||
|
5930000
|
trusted library section
|
page read and write
|
||
|
2BDD000
|
trusted library allocation
|
page execute and read and write
|
There are 232 hidden memdumps, click here to show them.