IOC Report
SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe.log
CSV text
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.InjectNET.17.23993.14959.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
 malicious

URLs

Name
IP
Malicious
https://locatedblsoqp.shop/api
188.114.97.3
 malicious
miracledzmnqwui.shop
malicious
https://traineiwnqo.shop/api
188.114.97.3
 malicious
condedqpwqm.shop
malicious
stamppreewntnq.shop
malicious
evoliutwoqm.shop
malicious
locatedblsoqp.shop
malicious
caffegclasiqwp.shop
malicious
https://miracledzmnqwui.shop/api
188.114.96.3
 malicious
millyscroqwp.shop
malicious
stagedchheiqwo.shop
malicious
traineiwnqo.shop
malicious
https://traineiwnqo.shop/.%
unknown
https://traineiwnqo.shop/&%
unknown
https://traineiwnqo.shop/apim
unknown
http://147.45.44.131/files/u888.exe
147.45.44.131
http://147.45.44.131/files/u888.exeP
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://traineiwnqo.shop/
unknown
http://147.45.44.131
unknown
There are 10 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
miracledzmnqwui.shop
188.114.96.3
 malicious
locatedblsoqp.shop
188.114.97.3
 malicious
traineiwnqo.shop
188.114.97.3
 malicious

IPs

IP
Domain
Country
Malicious
188.114.97.3
locatedblsoqp.shop
European Union
malicious
188.114.96.3
miracledzmnqwui.shop
European Union
malicious
147.45.44.131
unknown
Russian Federation

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
283A000
trusted library allocation
page read and write
2781000
trusted library allocation
page read and write
506E000
stack
page read and write
C9D000
trusted library allocation
page execute and read and write
73CF1000
unkown
page execute read
F0A000
heap
page read and write
4C2000
unkown
page readonly
542E000
stack
page read and write
9CA000
heap
page read and write
2838000
trusted library allocation
page read and write
5A6E000
stack
page read and write
556E000
stack
page read and write
F5A000
heap
page read and write
25FE000
stack
page read and write
5D0000
heap
page read and write
32BF000
stack
page read and write
55EE000
stack
page read and write
D10000
heap
page read and write
5C0000
heap
page read and write
990000
trusted library allocation
page read and write
9E7000
heap
page read and write
2834000
trusted library allocation
page read and write
2832000
trusted library allocation
page read and write
4C0000
unkown
page readonly
59DD000
stack
page read and write
D00000
trusted library allocation
page read and write
8F9000
stack
page read and write
C94000
trusted library allocation
page read and write
CBA000
trusted library allocation
page execute and read and write
5E6E000
stack
page read and write
546E000
stack
page read and write
2CFD000
stack
page read and write
E1F000
stack
page read and write
579E000
stack
page read and write
532E000
stack
page read and write
33FE000
stack
page read and write
A03000
heap
page read and write
51EE000
stack
page read and write
282A000
trusted library allocation
page read and write
562E000
stack
page read and write
FAC000
heap
page read and write
58DE000
stack
page read and write
5FAB000
stack
page read and write
9EB000
heap
page read and write
55C000
stack
page read and write
2BBE000
stack
page read and write
400000
remote allocation
page execute and read and write
11BE000
stack
page read and write
FBE000
heap
page read and write
51AE000
stack
page read and write
27FF000
trusted library allocation
page read and write
628E000
stack
page read and write
FA3000
heap
page read and write
2A7F000
stack
page read and write
A7F000
heap
page read and write
26FE000
stack
page read and write
CA0000
trusted library allocation
page read and write
CAD000
trusted library allocation
page execute and read and write
C90000
trusted library allocation
page read and write
10F0000
heap
page read and write
A7C000
heap
page read and write
4CDE000
stack
page read and write
CB7000
trusted library allocation
page execute and read and write
73CF0000
unkown
page readonly
572E000
stack
page read and write
9CE000
heap
page read and write
64D0000
heap
page read and write
63CE000
stack
page read and write
CF0000
trusted library allocation
page execute and read and write
4C6000
unkown
page readonly
27DE000
trusted library allocation
page read and write
614E000
stack
page read and write
F2E000
heap
page read and write
37E9000
trusted library allocation
page read and write
55AD000
stack
page read and write
589E000
stack
page read and write
9B6000
heap
page read and write
4F6E000
stack
page read and write
97E000
stack
page read and write
5BEE000
stack
page read and write
9B0000
heap
page read and write
C8E000
stack
page read and write
3789000
trusted library allocation
page read and write
73D0D000
unkown
page read and write
A6A000
heap
page read and write
F37000
heap
page read and write
115E000
stack
page read and write
EFC000
stack
page read and write
2740000
heap
page read and write
610E000
stack
page read and write
27FA000
trusted library allocation
page read and write
624F000
stack
page read and write
50AD000
stack
page read and write
638F000
stack
page read and write
64CE000
stack
page read and write
4D20000
heap
page execute and read and write
65D0000
heap
page read and write
5D2F000
stack
page read and write
2DFD000
stack
page read and write
9A0000
heap
page read and write
2836000
trusted library allocation
page read and write
F00000
heap
page read and write
5AEE000
stack
page read and write
9F5000
heap
page read and write
273C000
stack
page read and write
5EAD000
stack
page read and write
5AAE000
stack
page read and write
1010000
heap
page read and write
9A7000
heap
page read and write
D17000
heap
page read and write
FAF000
heap
page read and write
9C0000
heap
page read and write
52EE000
stack
page read and write
FB9000
heap
page read and write
5D6E000
stack
page read and write
CC7000
trusted library allocation
page execute and read and write
2760000
heap
page execute and read and write
C93000
trusted library allocation
page execute and read and write
73D06000
unkown
page readonly
5FB0000
heap
page read and write
2B7D000
stack
page read and write
CCB000
trusted library allocation
page execute and read and write
4D1E000
stack
page read and write
491E000
stack
page read and write
BE0000
heap
page read and write
5FC0000
heap
page read and write
2804000
trusted library allocation
page read and write
3781000
trusted library allocation
page read and write
11D0000
heap
page read and write
73D0F000
unkown
page readonly
4C90000
trusted library allocation
page read and write
BE5000
heap
page read and write
5740000
trusted library allocation
page read and write
32FE000
stack
page read and write
F26000
heap
page read and write
44A000
remote allocation
page execute and read and write
600E000
stack
page read and write
31BE000
stack
page read and write
2CBF000
stack
page read and write
5C2E000
stack
page read and write
356F000
stack
page read and write
346E000
stack
page read and write
93E000
stack
page read and write
2770000
heap
page read and write
F4E000
heap
page read and write
B9C000
stack
page read and write
1160000
heap
page read and write
There are 137 hidden memdumps, click here to show them.