IOC Report
QUOTATIONS#08673.exe

loading gif

Files

File Path
Type
Category
Malicious
QUOTATIONS#08673.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\newapp.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\shrugged
data
dropped
C:\Users\user\AppData\Roaming\newapp\newapp.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
modified
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\QUOTATIONS#08673.exe
"C:\Users\user\Desktop\QUOTATIONS#08673.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\QUOTATIONS#08673.exe"
 malicious
C:\Users\user\AppData\Roaming\newapp\newapp.exe
"C:\Users\user\AppData\Roaming\newapp\newapp.exe"
malicious
C:\Users\user\AppData\Roaming\newapp\newapp.exe
"C:\Users\user\AppData\Roaming\newapp\newapp.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://api.ipify.org/
172.67.74.152
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ftp.ercolina-usa.com
unknown
http://ercolina-usa.com
unknown

Domains

Name
IP
Malicious
ercolina-usa.com
192.254.225.136
 malicious
ftp.ercolina-usa.com
unknown
 malicious
api.ipify.org
172.67.74.152

IPs

IP
Domain
Country
Malicious
192.254.225.136
ercolina-usa.com
United States
malicious
172.67.74.152
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
newapp
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
system
page execute and read and write
 malicious
2D41000
trusted library allocation
page read and write
 malicious
2D6C000
trusted library allocation
page read and write
 malicious
4660000
direct allocation
page read and write
 malicious
52DE000
trusted library allocation
page read and write
790000
heap
page read and write
2ADB000
trusted library allocation
page execute and read and write
2D6A000
trusted library allocation
page read and write
430E000
heap
page read and write
430F000
heap
page read and write
4B30000
direct allocation
page read and write
121E000
stack
page read and write
130E000
stack
page read and write
542E000
stack
page read and write
2AD7000
trusted library allocation
page execute and read and write
4261000
heap
page read and write
6887000
trusted library allocation
page read and write
E40000
heap
page read and write
6BFB000
trusted library allocation
page read and write
2AC6000
trusted library allocation
page execute and read and write
482000
unkown
page readonly
42A5000
heap
page read and write
649E000
stack
page read and write
B1B000
heap
page read and write
E98000
heap
page read and write
89F000
stack
page read and write
4C5D000
direct allocation
page read and write
3BE1000
trusted library allocation
page read and write
2AD0000
trusted library allocation
page read and write
AA0000
heap
page read and write
4B30000
direct allocation
page read and write
4990000
direct allocation
page read and write
1000000
trusted library allocation
page read and write
4CF8000
trusted library allocation
page read and write
100D000
trusted library allocation
page execute and read and write
2D26000
trusted library allocation
page read and write
4261000
heap
page read and write
109E000
stack
page read and write
400000
system
page execute and read and write
6727000
trusted library allocation
page read and write
4E8E000
stack
page read and write
4200000
heap
page read and write
430F000
heap
page read and write
4200000
heap
page read and write
4C5D000
direct allocation
page read and write
4AB3000
direct allocation
page read and write
C4D000
trusted library allocation
page execute and read and write
400000
unkown
page readonly
78E000
stack
page read and write
4990000
direct allocation
page read and write
4C5D000
direct allocation
page read and write
4B30000
direct allocation
page read and write
6020000
heap
page read and write
BE0000
heap
page read and write
9AC000
stack
page read and write
C33000
trusted library allocation
page execute and read and write
2480000
trusted library allocation
page execute and read and write
2490000
trusted library allocation
page read and write
430E000
heap
page read and write
2D3D000
trusted library allocation
page read and write
4BB000
unkown
page readonly
4200000
heap
page read and write
2BE1000
trusted library allocation
page read and write
2AC0000
trusted library allocation
page read and write
4060000
heap
page read and write
247E000
stack
page read and write
3E85000
trusted library allocation
page read and write
C34000
trusted library allocation
page read and write
CFA000
stack
page read and write
8B4000
stack
page read and write
65B9000
trusted library allocation
page read and write
FE0000
trusted library allocation
page read and write
A80000
heap
page read and write
430E000
heap
page read and write
1300000
trusted library allocation
page read and write
3FFE000
heap
page read and write
430F000
heap
page read and write
6BEE000
stack
page read and write
4C59000
direct allocation
page read and write
2C9C000
stack
page read and write
4200000
heap
page read and write
430E000
heap
page read and write
C90000
heap
page read and write
2D7B000
trusted library allocation
page read and write
4200000
heap
page read and write
2AD5000
trusted library allocation
page execute and read and write
46DC000
stack
page read and write
4261000
heap
page read and write
430E000
heap
page read and write
6780000
trusted library allocation
page read and write
10A0000
trusted library allocation
page read and write
2AC2000
trusted library allocation
page read and write
980000
heap
page read and write
53B0000
heap
page read and write
EBA000
heap
page read and write
54BC000
stack
page read and write
430E000
heap
page read and write
2D72000
trusted library allocation
page read and write
430F000
heap
page read and write
4AB3000
direct allocation
page read and write
C3D000
trusted library allocation
page execute and read and write
6880000
trusted library allocation
page read and write
C40000
trusted library allocation
page read and write
6F80000
heap
page read and write
4990000
direct allocation
page read and write
4822000
heap
page read and write
12F0000
trusted library allocation
page execute and read and write
BB8000
stack
page read and write
430E000
heap
page read and write
430F000
heap
page read and write
F41000
heap
page read and write
1010000
heap
page read and write
2C5E000
stack
page read and write
4CCE000
direct allocation
page read and write
50F0000
trusted library allocation
page execute and read and write
4990000
direct allocation
page read and write
4261000
heap
page read and write
1260000
heap
page read and write
4AB3000
direct allocation
page read and write
430F000
heap
page read and write
2BD0000
heap
page execute and read and write
4261000
heap
page read and write
4140000
heap
page read and write
430F000
heap
page read and write
795000
heap
page read and write
E88000
heap
page read and write
1250000
trusted library allocation
page read and write
430F000
heap
page read and write
24A0000
trusted library allocation
page read and write
4200000
heap
page read and write
4261000
heap
page read and write
10B4000
trusted library allocation
page read and write
430E000
heap
page read and write
4C59000
direct allocation
page read and write
E58000
heap
page read and write
401000
unkown
page execute read
4D7E000
stack
page read and write
6710000
trusted library allocation
page read and write
3D57000
trusted library allocation
page read and write
10BD000
trusted library allocation
page execute and read and write
2F00000
trusted library allocation
page read and write
10B0000
trusted library allocation
page read and write
55FE000
stack
page read and write
6022000
heap
page read and write
F4E000
stack
page read and write
E2F000
heap
page read and write
42A5000
heap
page read and write
4271000
heap
page read and write
4261000
heap
page read and write
F66000
heap
page read and write
4EBE000
stack
page read and write
6C20000
trusted library allocation
page read and write
65FE000
stack
page read and write
430F000
heap
page read and write
4D3E000
stack
page read and write
4C59000
direct allocation
page read and write
53B4000
heap
page read and write
594E000
stack
page read and write
A10000
heap
page read and write
4C5D000
direct allocation
page read and write
2BC0000
trusted library allocation
page read and write
3287000
heap
page read and write
3FDF000
heap
page read and write
E3A000
heap
page read and write
686C000
stack
page read and write
430E000
heap
page read and write
E90000
heap
page read and write
1230000
trusted library allocation
page read and write
430E000
heap
page read and write
52F1000
trusted library allocation
page read and write
7F800000
trusted library allocation
page execute and read and write
4200000
heap
page read and write
430E000
heap
page read and write
4C59000
direct allocation
page read and write
342000
unkown
page readonly
2F17000
trusted library allocation
page read and write
490000
unkown
page write copy
8AF000
stack
page read and write
4200000
heap
page read and write
1E0000
heap
page read and write
FFD000
trusted library allocation
page execute and read and write
2D2F000
trusted library allocation
page read and write
41AA000
heap
page read and write
4FBE000
stack
page read and write
556F000
stack
page read and write
608E000
heap
page read and write
ACE000
stack
page read and write
645E000
stack
page read and write
93E000
stack
page read and write
9D0000
heap
page read and write
4261000
heap
page read and write
4AB000
unkown
page readonly
5320000
trusted library allocation
page read and write
537C000
stack
page read and write
430E000
heap
page read and write
6BF0000
trusted library allocation
page read and write
3410000
heap
page read and write
DF5000
heap
page read and write
4B40000
trusted library allocation
page execute and read and write
4CCE000
direct allocation
page read and write
2CF1000
trusted library allocation
page read and write
EC5000
heap
page read and write
EC7000
heap
page read and write
6870000
trusted library allocation
page execute and read and write
25FE000
stack
page read and write
546E000
stack
page read and write
430F000
heap
page read and write
4AB3000
direct allocation
page read and write
430E000
heap
page read and write
4261000
heap
page read and write
430F000
heap
page read and write
605A000
heap
page read and write
430E000
heap
page read and write
24F0000
heap
page read and write
430F000
heap
page read and write
5310000
trusted library allocation
page read and write
66FF000
stack
page read and write
5302000
trusted library allocation
page read and write
2D66000
trusted library allocation
page read and write
16DF000
stack
page read and write
4CCE000
direct allocation
page read and write
4200000
heap
page read and write
2D68000
trusted library allocation
page read and write
E50000
heap
page read and write
E55000
heap
page read and write
4200000
heap
page read and write
4279000
heap
page read and write
430F000
heap
page read and write
563E000
stack
page read and write
6720000
trusted library allocation
page read and write
12DE000
stack
page read and write
6026000
heap
page read and write
740000
heap
page read and write
430E000
heap
page read and write
A9E000
stack
page read and write
4261000
heap
page read and write
4BB000
unkown
page readonly
420E000
heap
page read and write
4668000
heap
page read and write
97E000
stack
page read and write
4AF000
unkown
page readonly
8A8000
heap
page read and write
100000
heap
page read and write
430F000
heap
page read and write
2AB0000
trusted library allocation
page read and write
3415000
heap
page read and write
430E000
heap
page read and write
B13000
heap
page read and write
2CD0000
trusted library allocation
page read and write
E34000
heap
page read and write
52FD000
trusted library allocation
page read and write
E18000
heap
page read and write
4261000
heap
page read and write
6AAF000
stack
page read and write
430F000
heap
page read and write
3F61000
heap
page read and write
E10000
heap
page read and write
3F5F000
stack
page read and write
2AF0000
trusted library allocation
page read and write
FF4000
trusted library allocation
page read and write
41FF000
heap
page execute and read and write
430F000
heap
page read and write
41E4000
heap
page read and write
1004000
trusted library allocation
page read and write
1237000
trusted library allocation
page execute and read and write
52E2000
trusted library allocation
page read and write
482000
unkown
page readonly
4B30000
direct allocation
page read and write
4261000
heap
page read and write
659E000
stack
page read and write
FF3000
trusted library allocation
page execute and read and write
682E000
stack
page read and write
DF0000
heap
page read and write
AC0000
heap
page read and write
47DE000
stack
page read and write
4A7000
unkown
page read and write
430F000
heap
page read and write
3601000
trusted library allocation
page read and write
671D000
trusted library allocation
page read and write
4B30000
direct allocation
page read and write
E46000
heap
page read and write
53A0000
heap
page execute and read and write
4200000
heap
page read and write
FA0000
heap
page read and write
430F000
heap
page read and write
3DC000
stack
page read and write
65A0000
heap
page read and write
4C59000
direct allocation
page read and write
430F000
heap
page read and write
4AB000
unkown
page readonly
573E000
stack
page read and write
AEA000
heap
page read and write
430F000
heap
page read and write
54FE000
stack
page read and write
4B30000
direct allocation
page read and write
AEE000
heap
page read and write
51BE000
stack
page read and write
AE0000
heap
page read and write
F8E000
stack
page read and write
4260000
heap
page read and write
9D4000
heap
page read and write
52EE000
trusted library allocation
page read and write
BCE000
stack
page read and write
4D70000
heap
page execute and read and write
440000
system
page execute and read and write
532E000
stack
page read and write
6790000
trusted library allocation
page execute and read and write
34A000
unkown
page readonly
3CF1000
trusted library allocation
page read and write
2B5E000
stack
page read and write
4AB3000
direct allocation
page read and write
4261000
heap
page read and write
401000
unkown
page execute read
2EB6000
trusted library allocation
page read and write
2ACA000
trusted library allocation
page execute and read and write
6C40000
heap
page read and write
2B10000
heap
page execute and read and write
2CE0000
heap
page read and write
4261000
heap
page read and write
2CB0000
heap
page read and write
6770000
trusted library allocation
page execute and read and write
6A6E000
stack
page read and write
4200000
heap
page read and write
52DB000
trusted library allocation
page read and write
52F6000
trusted library allocation
page read and write
4C59000
direct allocation
page read and write
88F000
heap
page read and write
9A000
stack
page read and write
4356000
heap
page read and write
1310000
heap
page read and write
EAE000
heap
page read and write
430F000
heap
page read and write
12AE000
stack
page read and write
878000
heap
page read and write
2F15000
trusted library allocation
page read and write
123B000
trusted library allocation
page execute and read and write
4200000
heap
page read and write
52BF000
stack
page read and write
11CE000
stack
page read and write
51E0000
heap
page read and write
120E000
stack
page read and write
4261000
heap
page read and write
2601000
trusted library allocation
page read and write
6AEE000
stack
page read and write
8FE000
stack
page read and write
4BFE000
stack
page read and write
A5E000
stack
page read and write
4E7F000
stack
page read and write
430F000
heap
page read and write
4CCE000
direct allocation
page read and write
10B3000
trusted library allocation
page execute and read and write
6A2C000
stack
page read and write
E37000
heap
page read and write
430F000
heap
page read and write
2F09000
trusted library allocation
page read and write
12EC000
stack
page read and write
6FA000
stack
page read and write
3B5E000
stack
page read and write
52D0000
trusted library allocation
page read and write
400000
unkown
page readonly
4261000
heap
page read and write
4CCE000
direct allocation
page read and write
894000
heap
page read and write
A70000
heap
page read and write
3F60000
heap
page read and write
6040000
heap
page read and write
4200000
heap
page read and write
4C5D000
direct allocation
page read and write
4990000
direct allocation
page read and write
430F000
heap
page read and write
4C5D000
direct allocation
page read and write
D10000
heap
page read and write
6C30000
trusted library allocation
page execute and read and write
430F000
heap
page read and write
430E000
heap
page read and write
4261000
heap
page read and write
430F000
heap
page read and write
676E000
stack
page read and write
E30000
heap
page read and write
4261000
heap
page read and write
65B0000
trusted library allocation
page read and write
ABA000
stack
page read and write
24B0000
heap
page execute and read and write
2BBF000
stack
page read and write
410E000
heap
page read and write
2EE5000
trusted library allocation
page read and write
430F000
heap
page read and write
2EC3000
trusted library allocation
page read and write
4AF000
unkown
page readonly
10C0000
heap
page read and write
52E0000
heap
page execute and read and write
C20000
trusted library allocation
page read and write
4CFE000
stack
page read and write
430E000
heap
page read and write
870000
heap
page read and write
4261000
heap
page read and write
C6B000
trusted library allocation
page execute and read and write
111F000
stack
page read and write
4200000
heap
page read and write
1ADF000
stack
page read and write
C44000
trusted library allocation
page read and write
E20000
heap
page read and write
430F000
heap
page read and write
C67000
trusted library allocation
page execute and read and write
4200000
heap
page read and write
51D0000
heap
page read and write
340000
unkown
page readonly
2AD2000
trusted library allocation
page read and write
E00000
heap
page read and write
2CA0000
trusted library allocation
page read and write
430F000
heap
page read and write
430E000
heap
page read and write
4990000
direct allocation
page read and write
3D19000
trusted library allocation
page read and write
2B00000
trusted library allocation
page execute and read and write
A6F000
stack
page read and write
89B000
heap
page read and write
4203000
heap
page read and write
4CCE000
direct allocation
page read and write
4AB3000
direct allocation
page read and write
2ABD000
trusted library allocation
page execute and read and write
EFB000
heap
page read and write
490000
unkown
page read and write
F1D000
heap
page read and write
471E000
heap
page read and write
There are 415 hidden memdumps, click here to show them.