IOC Report
DHL_Doc.9787653446578978656879764534576879764545766456.exe

loading gif

Files

File Path
Type
Category
Malicious
DHL_Doc.9787653446578978656879764534576879764545766456.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\aut3EFA.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\outbluffed
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe
"C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\DHL_Doc.9787653446578978656879764534576879764545766456.exe"
 malicious

URLs

Name
IP
Malicious
https://account.dyn.com/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
7C2000
system
page execute and read and write
 malicious
3C00000
direct allocation
page read and write
 malicious
3DB3000
direct allocation
page read and write
3F5D000
direct allocation
page read and write
2849000
trusted library allocation
page read and write
3D63000
direct allocation
page read and write
174A000
heap
page read and write
9F3000
trusted library allocation
page execute and read and write
11BC000
stack
page read and write
9E0000
trusted library allocation
page read and write
844000
unkown
page readonly
3D63000
direct allocation
page read and write
3C90000
direct allocation
page read and write
154F000
heap
page read and write
A10000
trusted library allocation
page read and write
C40000
trusted library allocation
page read and write
4C1B000
trusted library allocation
page read and write
5EF0000
trusted library allocation
page execute and read and write
3F59000
direct allocation
page read and write
2280000
heap
page read and write
15DD000
heap
page read and write
3C40000
direct allocation
page read and write
2180000
heap
page read and write
5A96000
heap
page read and write
175D000
heap
page read and write
3739000
trusted library allocation
page read and write
130E000
stack
page read and write
5EC0000
trusted library allocation
page read and write
529E000
stack
page read and write
4EDC000
stack
page read and write
3F7E000
direct allocation
page read and write
5A94000
heap
page read and write
3C40000
direct allocation
page read and write
3FCE000
direct allocation
page read and write
2820000
trusted library allocation
page read and write
3F09000
direct allocation
page read and write
A0D000
trusted library allocation
page execute and read and write
1536000
heap
page read and write
2830000
trusted library allocation
page read and write
BEE000
stack
page read and write
2822000
trusted library allocation
page read and write
3731000
trusted library allocation
page read and write
3F7E000
direct allocation
page read and write
9B0000
heap
page read and write
BA0000
heap
page read and write
14FE000
heap
page read and write
4C3D000
trusted library allocation
page read and write
3F0D000
direct allocation
page read and write
4C53000
heap
page read and write
3C90000
direct allocation
page read and write
4C70000
heap
page read and write
7FBD0000
trusted library allocation
page execute and read and write
505E000
stack
page read and write
CA0000
heap
page execute and read and write
935000
heap
page read and write
780000
unkown
page readonly
B04000
heap
page read and write
27A6000
trusted library allocation
page read and write
2843000
trusted library allocation
page read and write
174A000
heap
page read and write
83A000
unkown
page read and write
5D7E000
stack
page read and write
11FC000
stack
page read and write
3C90000
direct allocation
page read and write
3FCE000
direct allocation
page read and write
3DB3000
direct allocation
page read and write
2812000
trusted library allocation
page read and write
3759000
trusted library allocation
page read and write
1538000
heap
page read and write
3F09000
direct allocation
page read and write
5EB7000
trusted library allocation
page read and write
4C16000
trusted library allocation
page read and write
840000
heap
page read and write
A22000
trusted library allocation
page read and write
27F2000
trusted library allocation
page read and write
20EE000
stack
page read and write
3D63000
direct allocation
page read and write
80D000
unkown
page readonly
83A000
unkown
page write copy
B90000
heap
page read and write
27F8000
trusted library allocation
page read and write
3F09000
direct allocation
page read and write
1535000
heap
page read and write
82E000
unkown
page readonly
25FC000
stack
page read and write
A1A000
trusted library allocation
page execute and read and write
C90000
trusted library allocation
page execute and read and write
A68000
heap
page read and write
14FA000
heap
page read and write
4C2A000
trusted library allocation
page read and write
781000
unkown
page execute read
80D000
unkown
page readonly
ADB000
heap
page read and write
5EA0000
trusted library allocation
page execute and read and write
152B000
heap
page read and write
1555000
heap
page read and write
788000
stack
page read and write
B2A000
stack
page read and write
2610000
trusted library allocation
page read and write
A30000
heap
page read and write
9F0000
trusted library allocation
page read and write
AA5000
heap
page read and write
9F4000
trusted library allocation
page read and write
4C50000
heap
page read and write
930000
heap
page read and write
4C31000
trusted library allocation
page read and write
ABA000
heap
page read and write
3F09000
direct allocation
page read and write
3799000
trusted library allocation
page read and write
5A88000
heap
page read and write
15DC000
heap
page read and write
1536000
heap
page read and write
16BB000
heap
page read and write
501E000
stack
page read and write
4DD0000
heap
page execute and read and write
A2B000
trusted library allocation
page execute and read and write
11CF000
stack
page read and write
257F000
stack
page read and write
B1D000
heap
page read and write
5AA0000
heap
page read and write
1536000
heap
page read and write
3E30000
direct allocation
page read and write
3E30000
direct allocation
page read and write
3F7E000
direct allocation
page read and write
5F00000
heap
page read and write
15EF000
heap
page read and write
48CD000
stack
page read and write
3F0D000
direct allocation
page read and write
160E000
heap
page read and write
4C1E000
trusted library allocation
page read and write
844000
unkown
page readonly
2620000
heap
page read and write
3F5D000
direct allocation
page read and write
4738000
trusted library allocation
page read and write
281C000
trusted library allocation
page read and write
5F90000
trusted library allocation
page read and write
4C10000
trusted library allocation
page read and write
519D000
stack
page read and write
5EE0000
trusted library allocation
page read and write
1587000
heap
page read and write
CD6000
heap
page read and write
3DE0000
direct allocation
page read and write
5E7E000
stack
page read and write
781000
unkown
page execute read
82E000
unkown
page readonly
1793000
heap
page read and write
1CEE000
stack
page read and write
2765000
trusted library allocation
page read and write
5EC7000
trusted library allocation
page read and write
14F0000
heap
page read and write
4C36000
trusted library allocation
page read and write
5E80000
heap
page read and write
5F80000
heap
page read and write
780000
unkown
page readonly
3F59000
direct allocation
page read and write
2184000
heap
page read and write
1340000
heap
page read and write
4C2E000
trusted library allocation
page read and write
CB0000
trusted library allocation
page read and write
1794000
heap
page read and write
7C0000
system
page execute and read and write
3E30000
direct allocation
page read and write
515E000
stack
page read and write
A16000
trusted library allocation
page execute and read and write
3F0D000
direct allocation
page read and write
CD0000
heap
page read and write
5A40000
heap
page read and write
5EB0000
trusted library allocation
page read and write
3F5D000
direct allocation
page read and write
CC0000
trusted library allocation
page read and write
538E000
stack
page read and write
5ED0000
trusted library allocation
page read and write
152C000
heap
page read and write
3F7E000
direct allocation
page read and write
A12000
trusted library allocation
page read and write
4F1E000
stack
page read and write
5E90000
trusted library allocation
page read and write
11DB000
stack
page read and write
990000
heap
page read and write
9FD000
trusted library allocation
page execute and read and write
3C40000
direct allocation
page read and write
4C42000
trusted library allocation
page read and write
5A59000
heap
page read and write
A38000
heap
page read and write
A27000
trusted library allocation
page execute and read and write
169E000
heap
page read and write
3DE0000
direct allocation
page read and write
3F59000
direct allocation
page read and write
280C000
trusted library allocation
page read and write
3D63000
direct allocation
page read and write
3DB3000
direct allocation
page read and write
4DAC000
stack
page read and write
920000
heap
page read and write
174A000
heap
page read and write
534E000
stack
page read and write
22A0000
heap
page read and write
68A000
stack
page read and write
1749000
heap
page execute and read and write
4C22000
trusted library allocation
page read and write
3DE0000
direct allocation
page read and write
3F0D000
direct allocation
page read and write
2600000
trusted library allocation
page read and write
3FCE000
direct allocation
page read and write
C8E000
stack
page read and write
83F000
unkown
page write copy
A00000
trusted library allocation
page read and write
3C40000
direct allocation
page read and write
2731000
trusted library allocation
page read and write
A65000
heap
page read and write
3DE0000
direct allocation
page read and write
2835000
trusted library allocation
page read and write
1536000
heap
page read and write
174E000
heap
page read and write
There are 203 hidden memdumps, click here to show them.