IOC Report
snake.exe

loading gif

Files

File Path
Type
Category
Malicious
snake.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\snake.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\snake.exe
"C:\Users\user\Desktop\snake.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\snake.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3

URLs

Name
IP
Malicious
http://checkip.dyndns.org/
193.122.6.168
http://checkip.dyndns.comd
unknown
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.orgd
unknown
http://reallyfreegeoip.org
unknown
http://checkip.dyndns.orgd
unknown
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.97.3
http://checkip.dyndns.org/d
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 4 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.97.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
193.122.6.168

IPs

IP
Domain
Country
Malicious
188.114.97.3
reallyfreegeoip.org
European Union
malicious
193.122.6.168
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\snake_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\snake_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\snake_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\snake_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\snake_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\snake_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\snake_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\snake_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\snake_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\snake_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\snake_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\snake_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\snake_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\snake_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
FD2000
unkown
page readonly
 malicious
32D1000
trusted library allocation
page read and write
 malicious
33CF000
trusted library allocation
page read and write
3240000
heap
page read and write
66BF000
stack
page read and write
3427000
trusted library allocation
page read and write
3454000
trusted library allocation
page read and write
724C000
stack
page read and write
6AA0000
heap
page read and write
2AF0000
heap
page read and write
1840000
trusted library allocation
page execute and read and write
1387000
stack
page read and write
57D9000
trusted library allocation
page read and write
15A0000
trusted library allocation
page read and write
2AEF000
unkown
page read and write
341F000
trusted library allocation
page read and write
6AD8000
heap
page read and write
3396000
trusted library allocation
page read and write
3461000
trusted library allocation
page read and write
BF0000
heap
page read and write
6D3E000
stack
page read and write
34A4000
trusted library allocation
page read and write
349E000
trusted library allocation
page read and write
1679000
heap
page read and write
1400000
heap
page read and write
42F9000
trusted library allocation
page read and write
27D2000
heap
page read and write
15B4000
trusted library allocation
page read and write
15E2000
trusted library allocation
page read and write
2FA8000
heap
page read and write
E7F000
stack
page read and write
337E000
trusted library allocation
page read and write
18DC000
stack
page read and write
67BE000
stack
page read and write
15D2000
trusted library allocation
page read and write
57D6000
trusted library allocation
page read and write
3384000
trusted library allocation
page read and write
341B000
trusted library allocation
page read and write
65BE000
stack
page read and write
5B90000
heap
page execute and read and write
5950000
heap
page read and write
6C7E000
stack
page read and write
1634000
heap
page read and write
57E5000
trusted library allocation
page read and write
1810000
heap
page read and write
15E0000
trusted library allocation
page read and write
158E000
stack
page read and write
3398000
trusted library allocation
page read and write
714B000
stack
page read and write
13F0000
heap
page read and write
2F1F000
stack
page read and write
57C4000
trusted library allocation
page read and write
57D1000
trusted library allocation
page read and write
693E000
stack
page read and write
27BB000
heap
page read and write
15EB000
trusted library allocation
page execute and read and write
15D6000
trusted library allocation
page execute and read and write
586D000
stack
page read and write
15D0000
trusted library allocation
page read and write
1AFF000
stack
page read and write
1B20000
heap
page read and write
6A82000
heap
page read and write
15B0000
trusted library allocation
page read and write
161F000
heap
page read and write
33D7000
trusted library allocation
page read and write
33C7000
trusted library allocation
page read and write
3446000
trusted library allocation
page read and write
6CFF000
stack
page read and write
546C000
stack
page read and write
1641000
heap
page read and write
1470000
heap
page read and write
33B0000
trusted library allocation
page read and write
6B7E000
stack
page read and write
6A3E000
stack
page read and write
BE0000
heap
page read and write
275D000
stack
page read and write
6EFE000
stack
page read and write
160E000
heap
page read and write
42D7000
trusted library allocation
page read and write
1820000
heap
page read and write
2B40000
heap
page read and write
3389000
trusted library allocation
page read and write
5930000
trusted library allocation
page read and write
3417000
trusted library allocation
page read and write
1B06000
trusted library allocation
page read and write
342B000
trusted library allocation
page read and write
6A99000
heap
page read and write
338C000
trusted library allocation
page read and write
1475000
heap
page read and write
7250000
heap
page read and write
5B5E000
stack
page read and write
1B10000
trusted library allocation
page read and write
3490000
trusted library allocation
page read and write
6AA6000
heap
page read and write
1B00000
trusted library allocation
page read and write
3423000
trusted library allocation
page read and write
6CBD000
stack
page read and write
B7C000
stack
page read and write
5960000
heap
page read and write
189E000
stack
page read and write
2EDE000
stack
page read and write
1850000
heap
page execute and read and write
265D000
stack
page read and write
3381000
trusted library allocation
page read and write
3481000
trusted library allocation
page read and write
1600000
heap
page read and write
28B0000
heap
page read and write
42D1000
trusted library allocation
page read and write
128B000
stack
page read and write
3438000
trusted library allocation
page read and write
5D1D000
stack
page read and write
57B4000
trusted library allocation
page read and write
144D000
stack
page read and write
15B3000
trusted library allocation
page execute and read and write
5E1F000
stack
page read and write
5EDE000
stack
page read and write
6EBE000
stack
page read and write
FD0000
unkown
page readonly
15DA000
trusted library allocation
page execute and read and write
2FA0000
heap
page read and write
15E7000
trusted library allocation
page execute and read and write
18F0000
heap
page read and write
3379000
trusted library allocation
page read and write
6A44000
heap
page read and write
1800000
trusted library allocation
page read and write
347D000
trusted library allocation
page read and write
68FF000
stack
page read and write
28D0000
heap
page read and write
729E000
stack
page read and write
57BE000
trusted library allocation
page read and write
5800000
trusted library allocation
page read and write
3376000
trusted library allocation
page read and write
6AE5000
heap
page read and write
1B27000
heap
page read and write
33DB000
trusted library allocation
page read and write
19FE000
stack
page read and write
6FFF000
stack
page read and write
18E0000
trusted library allocation
page read and write
5E9E000
stack
page read and write
2C4F000
stack
page read and write
6E7E000
stack
page read and write
29EE000
unkown
page read and write
15BD000
trusted library allocation
page execute and read and write
33C5000
trusted library allocation
page read and write
33D3000
trusted library allocation
page read and write
739F000
stack
page read and write
27B0000
heap
page read and write
B3C000
stack
page read and write
6AC5000
heap
page read and write
E3E000
stack
page read and write
6E3F000
stack
page read and write
17FE000
stack
page read and write
3413000
trusted library allocation
page read and write
15C0000
trusted library allocation
page read and write
3387000
trusted library allocation
page read and write
5E5D000
stack
page read and write
340F000
trusted library allocation
page read and write
67FE000
stack
page read and write
2B3E000
stack
page read and write
6A40000
heap
page read and write
2F30000
heap
page read and write
There are 151 hidden memdumps, click here to show them.