IOC Report
New_Order_Inquiry.exe

loading gif

Files

File Path
Type
Category
Malicious
New_Order_Inquiry.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\Sheitan
data
dropped
C:\Users\user\AppData\Local\Temp\aut2F3.tmp
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\New_Order_Inquiry.exe
"C:\Users\user\Desktop\New_Order_Inquiry.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\New_Order_Inquiry.exe"
 malicious

URLs

Name
IP
Malicious
http://mail.zqamcx.com
unknown
http://zqamcx.com
unknown
https://account.dyn.com/
unknown
http://r11.o.lencr.org0#
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://r11.i.lencr.org/0#
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
mail.zqamcx.com
unknown
 malicious
zqamcx.com
78.110.166.82
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
78.110.166.82
zqamcx.com
United Kingdom

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
23C5000
trusted library allocation
page read and write
 malicious
412000
system
page execute and read and write
 malicious
2415000
trusted library allocation
page read and write
 malicious
23F2000
trusted library allocation
page read and write
 malicious
3810000
direct allocation
page read and write
 malicious
5680000
heap
page read and write
5719000
heap
page read and write
5B17000
trusted library allocation
page read and write
5BBD000
stack
page read and write
C61000
unkown
page execute read
3F09000
direct allocation
page read and write
80E000
stack
page read and write
3D63000
direct allocation
page read and write
1574000
heap
page read and write
642000
trusted library allocation
page read and write
1753000
heap
page read and write
17A6000
heap
page read and write
4852000
trusted library allocation
page read and write
1340000
heap
page read and write
C60000
unkown
page readonly
D57000
unkown
page readonly
4914000
heap
page read and write
D0E000
unkown
page readonly
3F0D000
direct allocation
page read and write
570000
heap
page read and write
708000
heap
page read and write
3F7E000
direct allocation
page read and write
154B000
heap
page read and write
601E000
stack
page read and write
4920000
heap
page read and write
3C40000
direct allocation
page read and write
6280000
trusted library allocation
page execute and read and write
490000
heap
page read and write
3F7E000
direct allocation
page read and write
5A0000
heap
page read and write
CED000
unkown
page readonly
115C000
stack
page read and write
D24000
unkown
page readonly
4FB0000
trusted library allocation
page read and write
610000
trusted library allocation
page read and write
D1A000
unkown
page write copy
3D63000
direct allocation
page read and write
950000
heap
page read and write
3F7E000
direct allocation
page read and write
C40000
heap
page read and write
3D63000
direct allocation
page read and write
44CE000
stack
page read and write
3D63000
direct allocation
page read and write
6290000
heap
page read and write
2423000
trusted library allocation
page read and write
3DE0000
direct allocation
page read and write
615E000
stack
page read and write
5CA0000
trusted library allocation
page read and write
5BC0000
trusted library allocation
page read and write
117B000
stack
page read and write
705000
heap
page read and write
1797000
heap
page read and write
5CAB000
trusted library allocation
page read and write
2270000
heap
page read and write
4810000
heap
page read and write
16B5000
heap
page read and write
410000
system
page execute and read and write
2380000
heap
page execute and read and write
3D63000
direct allocation
page read and write
3F0D000
direct allocation
page read and write
65B000
trusted library allocation
page execute and read and write
D1A000
unkown
page read and write
5B00000
trusted library allocation
page read and write
1750000
heap
page read and write
16C4000
heap
page read and write
3F09000
direct allocation
page read and write
23F0000
trusted library allocation
page read and write
62D000
trusted library allocation
page execute and read and write
484E000
trusted library allocation
page read and write
2411000
trusted library allocation
page read and write
D0E000
unkown
page readonly
174C000
heap
page read and write
210E000
stack
page read and write
9B0000
trusted library allocation
page read and write
59BF000
stack
page read and write
151E000
heap
page read and write
15F9000
heap
page read and write
5B20000
trusted library allocation
page read and write
15F8000
heap
page read and write
61D000
trusted library allocation
page execute and read and write
655000
trusted library allocation
page execute and read and write
D1F000
unkown
page write copy
9DE000
stack
page read and write
59FD000
stack
page read and write
611E000
stack
page read and write
3F7E000
direct allocation
page read and write
3F7E000
direct allocation
page read and write
3F0D000
direct allocation
page read and write
4B1C000
stack
page read and write
C60000
unkown
page readonly
1552000
heap
page read and write
4890000
trusted library allocation
page read and write
5F5D000
stack
page read and write
3F09000
direct allocation
page read and write
652000
trusted library allocation
page read and write
1555000
heap
page read and write
5A5000
heap
page read and write
600000
trusted library allocation
page read and write
657000
trusted library allocation
page execute and read and write
5B10000
trusted library allocation
page read and write
2428000
trusted library allocation
page read and write
5C9E000
stack
page read and write
38F0000
heap
page read and write
3F7E000
direct allocation
page read and write
3F0D000
direct allocation
page read and write
7F990000
trusted library allocation
page execute and read and write
484B000
trusted library allocation
page read and write
1750000
heap
page read and write
119D000
stack
page read and write
C61000
unkown
page execute read
3DE0000
direct allocation
page read and write
3C40000
direct allocation
page read and write
485E000
trusted library allocation
page read and write
2391000
trusted library allocation
page read and write
56FE000
heap
page read and write
CED000
unkown
page readonly
77E000
heap
page read and write
3F09000
direct allocation
page read and write
3C40000
direct allocation
page read and write
6D0000
heap
page read and write
6C0000
trusted library allocation
page execute and read and write
1555000
heap
page read and write
3DE0000
direct allocation
page read and write
15F8000
heap
page read and write
4FA0000
heap
page read and write
5B07000
trusted library allocation
page read and write
3F0D000
direct allocation
page read and write
174C000
heap
page read and write
241D000
trusted library allocation
page read and write
116F000
stack
page read and write
1320000
heap
page read and write
3D63000
direct allocation
page read and write
3DE0000
direct allocation
page read and write
1510000
heap
page read and write
5AFD000
stack
page read and write
DA000
stack
page read and write
6270000
trusted library allocation
page read and write
3C40000
direct allocation
page read and write
89E000
stack
page read and write
1D0E000
stack
page read and write
6D8000
heap
page read and write
4FC0000
trusted library allocation
page execute and read and write
3D63000
direct allocation
page read and write
D57000
unkown
page readonly
226F000
stack
page read and write
3F0D000
direct allocation
page read and write
9C0000
heap
page read and write
640000
trusted library allocation
page read and write
5B70000
trusted library allocation
page execute and read and write
4866000
trusted library allocation
page read and write
8DA000
stack
page read and write
24FD000
trusted library allocation
page read and write
237E000
stack
page read and write
7A3000
heap
page read and write
85E000
stack
page read and write
3F09000
direct allocation
page read and write
613000
trusted library allocation
page execute and read and write
646000
trusted library allocation
page execute and read and write
3C40000
direct allocation
page read and write
486D000
trusted library allocation
page read and write
3DE0000
direct allocation
page read and write
242C000
trusted library allocation
page read and write
1555000
heap
page read and write
1609000
heap
page read and write
4910000
heap
page read and write
1796000
heap
page read and write
4900000
heap
page execute and read and write
4880000
trusted library allocation
page read and write
175F000
heap
page read and write
3F7E000
direct allocation
page read and write
3DE0000
direct allocation
page read and write
5C5E000
stack
page read and write
2404000
trusted library allocation
page read and write
630000
heap
page read and write
38F4000
heap
page read and write
9C6000
heap
page read and write
1628000
heap
page read and write
3F0D000
direct allocation
page read and write
4830000
trusted library allocation
page read and write
1D9000
stack
page read and write
6BE000
stack
page read and write
174B000
heap
page execute and read and write
6EE000
heap
page read and write
918000
trusted library allocation
page read and write
625E000
stack
page read and write
4FB8000
trusted library allocation
page read and write
33B9000
trusted library allocation
page read and write
620000
trusted library allocation
page read and write
5EE000
stack
page read and write
4C2E000
unkown
page read and write
99E000
stack
page read and write
33F8000
trusted library allocation
page read and write
3F09000
direct allocation
page read and write
4840000
trusted library allocation
page read and write
6F9000
heap
page read and write
5B2D000
trusted library allocation
page read and write
1582000
heap
page read and write
3391000
trusted library allocation
page read and write
3F09000
direct allocation
page read and write
65F0000
heap
page read and write
614000
trusted library allocation
page read and write
154A000
heap
page read and write
3DE0000
direct allocation
page read and write
73D000
heap
page read and write
3C40000
direct allocation
page read and write
5694000
heap
page read and write
4938000
heap
page read and write
670000
trusted library allocation
page read and write
940000
heap
page read and write
43CC000
stack
page read and write
4F9D000
stack
page read and write
64A000
trusted library allocation
page execute and read and write
D24000
unkown
page readonly
4872000
trusted library allocation
page read and write
174C000
heap
page read and write
4861000
trusted library allocation
page read and write
151A000
heap
page read and write
3C40000
direct allocation
page read and write
48EC000
stack
page read and write
There are 214 hidden memdumps, click here to show them.