IOC Report
WEAREX_IHRACAT.exe

loading gif

Files

File Path
Type
Category
Malicious
WEAREX_IHRACAT.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\Pregnancy\Caterva.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
dropped
 malicious
C:\Users\user\AppData\Local\Temp\nseB6DC.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\nsrB208.tmp
data
dropped
C:\Users\user\gangningerne\jot\mtn\Discomplexion\Modulsystemernes.Tie
data
dropped
C:\Users\user\gangningerne\jot\mtn\Discomplexion\Sengeheste.txt
ASCII text, with CRLF line terminators
dropped
C:\Users\user\gangningerne\jot\mtn\Discomplexion\Soldede.Phy
ASCII text, with very long lines (65536), with no line terminators
dropped
C:\Users\user\gangningerne\jot\mtn\Discomplexion\hulen.urh
data
dropped
C:\Users\user\gangningerne\jot\mtn\Discomplexion\isvintrene.gaf
data
dropped
C:\Users\user\gangningerne\jot\mtn\Discomplexion\rustling.avi
data
dropped
C:\Windows\Fonts\logorrheic.ini
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\WEAREX_IHRACAT.exe
"C:\Users\user\Desktop\WEAREX_IHRACAT.exe"
 malicious
C:\Users\user\Desktop\WEAREX_IHRACAT.exe
"C:\Users\user\Desktop\WEAREX_IHRACAT.exe"
 malicious

URLs

Name
IP
Malicious
https://gitak.top/dmAaHCQMI79.bin/9~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin6
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin5
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/A~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin)
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.bin6
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin0
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binM~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binD
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binNJ
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bine~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.bin
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binY~
unknown
 malicious
https://gitak.top/W~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/o~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binR
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/Y~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binR
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binX
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/K~v
unknown
 malicious
https://gitak.top/e~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binK
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin-~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binX
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bino~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binA~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binK~v
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin
172.67.207.219
 malicious
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binD
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binf
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin9~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/M~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bince
unknown
 malicious
https://gitak.top/7~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binq
unknown
 malicious
https://gitak.top/A~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binW~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/7~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binz
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binl
unknown
 malicious
https://gitak.top/
unknown
 malicious
https://gitak.top/M~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binc~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/e~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binMicrosoft
unknown
 malicious
https://gitak.top/K~v
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/dmAaHCQMI79.binl
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binz
unknown
 malicious
https://gitak.top/My
unknown
 malicious
https://gitak.top/Y~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin7~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/W~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin/c~
unknown
 malicious
https://gitak.top/dmAaHCQMI79.bin(
unknown
 malicious
https://gitak.top/dmAaHCQMI79.binAuthority
unknown
 malicious
https://gitak.top/o~
unknown
 malicious
https://gitak.top/9~
unknown
 malicious
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
unknown
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD
unknown
http://www.gopher.ftp://ftp.
unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/frameset.dtd
unknown
https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
unknown
https://ocsp.quovadisoffshore.com0
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown
http://www.w3c.org/TR/1999/REC-html401-19991224/loose.dtd
unknown
http://www.quovadis.bm0
unknown
There are 57 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
gitak.top
172.67.207.219

IPs

IP
Domain
Country
Malicious
172.67.207.219
gitak.top
United States

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Aaregang
 malicious
HKEY_CURRENT_USER\agapemonite\derate\Ssterpartiet
muncher
HKEY_CURRENT_USER\falbydelsens\goshdarn\anflyvningen
omstbninger
HKEY_CURRENT_USER\overlusciously\Microsoft\Windows\Misallotment\Uninstall\vitrescent
catchingly

Memdumps

Base Address
Regiontype
Protect
Malicious
31C1000
direct allocation
page execute and read and write
 malicious
1721000
remote allocation
page execute and read and write
 malicious
2866000
heap
page read and write
28F8000
heap
page read and write
42A0000
direct allocation
page read and write
28F8000
heap
page read and write
4B0000
heap
page read and write
2905000
heap
page read and write
28A3000
heap
page read and write
2897000
heap
page read and write
290A000
heap
page read and write
2890000
heap
page read and write
326E0000
remote allocation
page read and write
2866000
heap
page read and write
40D0000
direct allocation
page read and write
287A000
heap
page read and write
323A0000
direct allocation
page read and write
290A000
heap
page read and write
28A3000
heap
page read and write
31E71000
heap
page read and write
2890000
heap
page read and write
28F6000
heap
page read and write
2905000
heap
page read and write
10005000
unkown
page readonly
281E000
stack
page read and write
4280000
trusted library allocation
page read and write
28F8000
heap
page read and write
290A000
heap
page read and write
1660000
remote allocation
page execute and read and write
4F8000
heap
page read and write
28AA000
heap
page read and write
28FF000
heap
page read and write
28B0000
heap
page read and write
28F8000
heap
page read and write
28F6000
heap
page read and write
2A20000
direct allocation
page read and write
42E0000
direct allocation
page read and write
326E0000
remote allocation
page read and write
2900000
heap
page read and write
28AA000
heap
page read and write
2897000
heap
page read and write
2930000
heap
page read and write
667000
heap
page read and write
28AA000
heap
page read and write
28A3000
heap
page read and write
28F8000
heap
page read and write
28F8000
heap
page read and write
28A3000
heap
page read and write
3BC1000
direct allocation
page execute and read and write
28A3000
heap
page read and write
16B000
stack
page read and write
28A3000
heap
page read and write
2890000
heap
page read and write
2AA0000
direct allocation
page read and write
2890000
heap
page read and write
232E000
stack
page read and write
28AA000
heap
page read and write
2897000
heap
page read and write
28F8000
heap
page read and write
2890000
heap
page read and write
2905000
heap
page read and write
28A3000
heap
page read and write
4280000
direct allocation
page read and write
2905000
heap
page read and write
28F8000
heap
page read and write
28F8000
heap
page read and write
2A90000
direct allocation
page read and write
626000
unkown
page execute read
28F8000
heap
page read and write
28FF000
heap
page read and write
28A3000
heap
page read and write
434000
unkown
page read and write
28AA000
heap
page read and write
28A3000
heap
page read and write
2680000
heap
page read and write
401000
unkown
page execute read
287D000
heap
page read and write
2A00000
direct allocation
page read and write
4290000
direct allocation
page read and write
2897000
heap
page read and write
28F8000
heap
page read and write
28B0000
heap
page read and write
31F90000
direct allocation
page read and write
28F8000
heap
page read and write
28AA000
heap
page read and write
290A000
heap
page read and write
290A000
heap
page read and write
2897000
heap
page read and write
28B0000
heap
page read and write
40F0000
direct allocation
page read and write
28AA000
heap
page read and write
28B2000
heap
page read and write
28B2000
heap
page read and write
2906000
heap
page read and write
401000
unkown
page execute read
28F8000
heap
page read and write
2838000
heap
page read and write
42C000
unkown
page read and write
2900000
heap
page read and write
28AA000
heap
page read and write
40C0000
direct allocation
page read and write
287A000
heap
page read and write
2897000
heap
page read and write
31E70000
heap
page read and write
28A3000
heap
page read and write
2897000
heap
page read and write
28B0000
heap
page read and write
4272000
trusted library allocation
page read and write
2900000
heap
page read and write
28AB000
heap
page read and write
28F8000
heap
page read and write
22E0000
heap
page read and write
28F8000
heap
page read and write
28AA000
heap
page read and write
2684000
heap
page read and write
649000
unkown
page execute read
4100000
direct allocation
page read and write
2905000
heap
page read and write
28AA000
heap
page read and write
28F8000
heap
page read and write
28A3000
heap
page read and write
290A000
heap
page read and write
2906000
heap
page read and write
2905000
heap
page read and write
28B2000
heap
page read and write
28AA000
heap
page read and write
2897000
heap
page read and write
28F8000
heap
page read and write
9B000
stack
page read and write
2905000
heap
page read and write
28F8000
heap
page read and write
290A000
heap
page read and write
28B2000
heap
page read and write
28F8000
heap
page read and write
4250000
direct allocation
page read and write
2866000
heap
page read and write
28B2000
heap
page read and write
409000
unkown
page write copy
2905000
heap
page read and write
28B2000
heap
page read and write
409000
unkown
page write copy
28AA000
heap
page read and write
2906000
heap
page read and write
2905000
heap
page read and write
28A3000
heap
page read and write
290A000
heap
page read and write
2897000
heap
page read and write
28AA000
heap
page read and write
28F8000
heap
page read and write
407000
unkown
page readonly
2A70000
direct allocation
page read and write
28F8000
heap
page read and write
2905000
heap
page read and write
2866000
heap
page read and write
290A000
heap
page read and write
28A3000
heap
page read and write
28F4000
heap
page read and write
2220000
heap
page read and write
28F8000
heap
page read and write
290A000
heap
page read and write
2897000
heap
page read and write
2906000
heap
page read and write
28AA000
heap
page read and write
28F8000
heap
page read and write
2897000
heap
page read and write
2A60000
direct allocation
page read and write
4BE000
heap
page read and write
290A000
heap
page read and write
28F8000
heap
page read and write
44E000
unkown
page read and write
4230000
direct allocation
page read and write
28F8000
heap
page read and write
2AB0000
direct allocation
page read and write
453000
unkown
page readonly
28A3000
heap
page read and write
2905000
heap
page read and write
290A000
heap
page read and write
28A3000
heap
page read and write
290A000
heap
page read and write
10003000
unkown
page readonly
28F8000
heap
page read and write
28A3000
heap
page read and write
28F8000
heap
page read and write
3100000
direct allocation
page execute and read and write
2897000
heap
page read and write
28B2000
heap
page read and write
2890000
heap
page read and write
28F8000
heap
page read and write
28A3000
heap
page read and write
287D000
heap
page read and write
28F8000
heap
page read and write
2900000
heap
page read and write
290A000
heap
page read and write
290A000
heap
page read and write
2905000
heap
page read and write
10059000
trusted library allocation
page read and write
28A3000
heap
page read and write
28B2000
heap
page read and write
290A000
heap
page read and write
401000
unkown
page execute read
28F8000
heap
page read and write
290A000
heap
page read and write
28AA000
heap
page read and write
28F8000
heap
page read and write
2905000
heap
page read and write
290A000
heap
page read and write
5EE000
unkown
page execute read
4F2000
heap
page read and write
42D0000
direct allocation
page read and write
10020000
trusted library allocation
page read and write
28B2000
heap
page read and write
28AA000
heap
page read and write
2890000
heap
page read and write
28F8000
heap
page read and write
290A000
heap
page read and write
3278D000
heap
page read and write
287A000
heap
page read and write
290E000
heap
page read and write
2A50000
direct allocation
page read and write
2A80000
direct allocation
page read and write
3271E000
stack
page read and write
287A000
heap
page read and write
19B000
stack
page read and write
10001000
unkown
page execute read
28F5000
heap
page read and write
2906000
heap
page read and write
28F8000
heap
page read and write
31F70000
direct allocation
page read and write
5EC000
unkown
page execute read
28A3000
heap
page read and write
2820000
direct allocation
page read and write
2905000
heap
page read and write
290A000
heap
page read and write
2AC0000
heap
page read and write
28A3000
heap
page read and write
28A3000
heap
page read and write
665000
heap
page read and write
2897000
heap
page read and write
290A000
heap
page read and write
2890000
heap
page read and write
40E0000
direct allocation
page read and write
28AA000
heap
page read and write
28F8000
heap
page read and write
28F8000
heap
page read and write
290A000
heap
page read and write
3275F000
stack
page read and write
28F8000
heap
page read and write
28AA000
heap
page read and write
4BA000
heap
page read and write
290A000
heap
page read and write
2905000
heap
page read and write
426000
unkown
page read and write
2905000
heap
page read and write
2890000
heap
page read and write
2890000
heap
page read and write
28F8000
heap
page read and write
27BE000
stack
page read and write
453000
unkown
page readonly
401000
unkown
page execute read
660000
heap
page read and write
31F80000
direct allocation
page read and write
2905000
heap
page read and write
28F8000
heap
page read and write
2905000
heap
page read and write
287A000
heap
page read and write
287A000
heap
page read and write
2A10000
direct allocation
page read and write
2897000
heap
page read and write
28A3000
heap
page read and write
2900000
heap
page read and write
325EF000
stack
page read and write
290A000
heap
page read and write
2900000
heap
page read and write
2900000
heap
page read and write
28AA000
heap
page read and write
2900000
heap
page read and write
28B2000
heap
page read and write
31FD0000
heap
page read and write
42C0000
direct allocation
page read and write
28A3000
heap
page read and write
28AA000
heap
page read and write
2866000
heap
page read and write
28F8000
heap
page read and write
28A3000
heap
page read and write
28AA000
heap
page read and write
28B2000
heap
page read and write
28F8000
heap
page read and write
4260000
direct allocation
page read and write
28F8000
heap
page read and write
2897000
heap
page read and write
9B000
stack
page read and write
28F8000
heap
page read and write
28AA000
heap
page read and write
28B2000
heap
page read and write
2890000
heap
page read and write
28A3000
heap
page read and write
2830000
heap
page read and write
400000
unkown
page readonly
28A3000
heap
page read and write
407000
unkown
page readonly
28A3000
heap
page read and write
28A3000
heap
page read and write
28F8000
heap
page read and write
28F8000
heap
page read and write
28A3000
heap
page read and write
29F0000
direct allocation
page read and write
2890000
heap
page read and write
327A0000
heap
page read and write
2905000
heap
page read and write
5F2000
unkown
page execute read
2897000
heap
page read and write
31FA0000
direct allocation
page read and write
28F8000
heap
page read and write
2121000
remote allocation
page execute and read and write
325AE000
stack
page read and write
22A0000
heap
page read and write
28A3000
heap
page read and write
2890000
heap
page read and write
28AA000
heap
page read and write
28B2000
heap
page read and write
28B0000
heap
page read and write
28EA000
heap
page read and write
28F8000
heap
page read and write
32320000
heap
page read and write
28A3000
heap
page read and write
28A3000
heap
page read and write
2905000
heap
page read and write
2905000
heap
page read and write
290E000
heap
page read and write
32390000
direct allocation
page read and write
451000
unkown
page read and write
28A3000
heap
page read and write
28AA000
heap
page read and write
2900000
heap
page read and write
28F8000
heap
page read and write
5EA000
unkown
page execute read
2866000
heap
page read and write
265E000
stack
page read and write
2897000
heap
page read and write
2905000
heap
page read and write
28AA000
heap
page read and write
290A000
heap
page read and write
28F8000
heap
page read and write
400000
unkown
page readonly
42B0000
direct allocation
page read and write
28AA000
heap
page read and write
28B2000
heap
page read and write
290A000
heap
page read and write
2890000
heap
page read and write
2897000
heap
page read and write
2906000
heap
page read and write
2370000
heap
page read and write
28AA000
heap
page read and write
28F8000
heap
page read and write
287A000
heap
page read and write
28AA000
heap
page read and write
28AA000
heap
page read and write
2897000
heap
page read and write
28B2000
heap
page read and write
2905000
heap
page read and write
2A30000
direct allocation
page read and write
28F8000
heap
page read and write
470000
heap
page read and write
28F8000
heap
page read and write
290A000
heap
page read and write
30000
heap
page read and write
28F8000
heap
page read and write
28AA000
heap
page read and write
5E8000
unkown
page execute read
28F8000
heap
page read and write
28F8000
heap
page read and write
290E000
heap
page read and write
407000
unkown
page readonly
28F8000
heap
page read and write
28AA000
heap
page read and write
5F0000
unkown
page execute read
290A000
heap
page read and write
2900000
heap
page read and write
28F8000
heap
page read and write
2890000
heap
page read and write
28F8000
heap
page read and write
30000
heap
page read and write
28F8000
heap
page read and write
4270000
direct allocation
page read and write
2900000
heap
page read and write
28F8000
heap
page read and write
326E0000
remote allocation
page read and write
31FC0000
direct allocation
page read and write
400000
unkown
page readonly
2900000
heap
page read and write
290A000
heap
page read and write
28B0000
heap
page read and write
28B0000
heap
page read and write
27DE000
stack
page read and write
453000
unkown
page readonly
28AA000
heap
page read and write
28F8000
heap
page read and write
28FF000
heap
page read and write
10000000
unkown
page readonly
290E000
heap
page read and write
2897000
heap
page read and write
28F8000
heap
page read and write
28B2000
heap
page read and write
4110000
heap
page read and write
290A000
heap
page read and write
2897000
heap
page read and write
28AA000
heap
page read and write
409000
unkown
page read and write
32780000
heap
page read and write
2905000
heap
page read and write
28FF000
heap
page read and write
2897000
heap
page read and write
290A000
heap
page read and write
2905000
heap
page read and write
4210000
direct allocation
page read and write
2867000
heap
page read and write
2897000
heap
page read and write
445000
unkown
page read and write
287A000
heap
page read and write
4240000
direct allocation
page read and write
28F8000
heap
page read and write
28F8000
heap
page read and write
4111000
heap
page read and write
279F000
stack
page read and write
28F8000
heap
page read and write
28F8000
heap
page read and write
28F8000
heap
page read and write
28F8000
heap
page read and write
28A3000
heap
page read and write
290A000
heap
page read and write
28AA000
heap
page read and write
28F8000
heap
page read and write
2905000
heap
page read and write
2866000
heap
page read and write
290A000
heap
page read and write
290A000
heap
page read and write
28F8000
heap
page read and write
There are 427 hidden memdumps, click here to show them.