IOC Report
114mCZlpa3.exe

loading gif

Files

File Path
Type
Category
Malicious
114mCZlpa3.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\chiffons
MIPSEB MIPS-II ECOFF executable not stripped - version 50.68
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\114mCZlpa3.exe
"C:\Users\user\Desktop\114mCZlpa3.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\114mCZlpa3.exe"
 malicious

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
193.122.6.168
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.97.3
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.97.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
193.122.6.168

IPs

IP
Domain
Country
Malicious
188.114.97.3
reallyfreegeoip.org
European Union
malicious
193.122.6.168
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
system
page execute and read and write
 malicious
1690000
direct allocation
page read and write
 malicious
2701000
trusted library allocation
page read and write
 malicious
28CD000
trusted library allocation
page read and write
 malicious
4490000
direct allocation
page read and write
2948000
trusted library allocation
page read and write
1680000
heap
page read and write
27E1000
trusted library allocation
page read and write
3E1D000
heap
page read and write
9A000
stack
page read and write
2869000
trusted library allocation
page read and write
9A0000
heap
page read and write
5D64000
heap
page read and write
5030000
heap
page execute and read and write
4759000
direct allocation
page read and write
2938000
trusted library allocation
page read and write
4BEE000
trusted library allocation
page read and write
4BE0000
trusted library allocation
page read and write
4A8000
unkown
page read and write
4BFA000
trusted library allocation
page read and write
3785000
trusted library allocation
page read and write
830000
heap
page read and write
492000
unkown
page read and write
3CF9000
heap
page read and write
4490000
direct allocation
page read and write
268E000
stack
page read and write
27C8000
trusted library allocation
page read and write
96A000
heap
page read and write
3C90000
heap
page read and write
61B0000
trusted library allocation
page execute and read and write
5188000
trusted library allocation
page read and write
4490000
direct allocation
page read and write
3CE3000
heap
page read and write
2884000
trusted library allocation
page read and write
5180000
trusted library allocation
page read and write
24ED000
trusted library allocation
page execute and read and write
66C0000
heap
page read and write
4630000
direct allocation
page read and write
2507000
trusted library allocation
page execute and read and write
2853000
trusted library allocation
page read and write
250B000
trusted library allocation
page execute and read and write
45B3000
direct allocation
page read and write
29C1000
trusted library allocation
page read and write
293F000
trusted library allocation
page read and write
475D000
direct allocation
page read and write
2520000
trusted library allocation
page read and write
4630000
direct allocation
page read and write
3CE8000
heap
page read and write
8FE000
stack
page read and write
475D000
direct allocation
page read and write
378E000
stack
page read and write
26E0000
heap
page read and write
3F19000
heap
page read and write
3BEC000
heap
page read and write
284B000
trusted library allocation
page read and write
2984000
trusted library allocation
page read and write
2505000
trusted library allocation
page execute and read and write
3CF7000
heap
page read and write
5E3E000
stack
page read and write
2934000
trusted library allocation
page read and write
285B000
trusted library allocation
page read and write
429A000
heap
page read and write
27AE000
trusted library allocation
page read and write
6230000
trusted library allocation
page read and write
5020000
trusted library allocation
page read and write
3CE5000
heap
page read and write
835000
heap
page read and write
24F0000
trusted library allocation
page read and write
3D61000
heap
page read and write
CDE000
stack
page read and write
4C20000
trusted library allocation
page read and write
4490000
direct allocation
page read and write
27FF000
trusted library allocation
page read and write
8AF000
stack
page read and write
2858000
trusted library allocation
page read and write
24DD000
trusted library allocation
page execute and read and write
155F000
stack
page read and write
A5E000
stack
page read and write
888000
heap
page read and write
4630000
direct allocation
page read and write
93E000
stack
page read and write
2952000
trusted library allocation
page read and write
6190000
trusted library allocation
page read and write
295B000
trusted library allocation
page read and write
24FA000
trusted library allocation
page execute and read and write
6193000
trusted library allocation
page read and write
125000
heap
page read and write
4CBD000
stack
page read and write
4BFE000
trusted library allocation
page read and write
2570000
trusted library allocation
page execute and read and write
BDE000
stack
page read and write
5010000
trusted library allocation
page execute and read and write
3701000
trusted library allocation
page read and write
280B000
trusted library allocation
page read and write
950000
heap
page read and write
4759000
direct allocation
page read and write
4490000
direct allocation
page read and write
27B3000
trusted library allocation
page read and write
27C6000
trusted library allocation
page read and write
45B3000
direct allocation
page read and write
4BF2000
trusted library allocation
page read and write
6180000
trusted library allocation
page execute and read and write
47CE000
direct allocation
page read and write
3044000
heap
page read and write
3D2E000
heap
page read and write
5EBE000
stack
page read and write
4AB000
unkown
page readonly
4C50000
trusted library allocation
page read and write
4630000
direct allocation
page read and write
2843000
trusted library allocation
page read and write
24F6000
trusted library allocation
page execute and read and write
298A000
trusted library allocation
page read and write
4759000
direct allocation
page read and write
3F19000
heap
page read and write
850000
heap
page read and write
518B000
trusted library allocation
page read and write
3D31000
heap
page read and write
917000
heap
page read and write
283F000
trusted library allocation
page read and write
376A000
trusted library allocation
page read and write
4759000
direct allocation
page read and write
513E000
stack
page read and write
4490000
direct allocation
page read and write
2892000
trusted library allocation
page read and write
619A000
trusted library allocation
page read and write
26D0000
trusted library allocation
page read and write
4BEB000
trusted library allocation
page read and write
960000
heap
page read and write
4759000
direct allocation
page read and write
3B8F000
stack
page read and write
490000
unkown
page write copy
2986000
trusted library allocation
page read and write
47CE000
direct allocation
page read and write
400000
system
page execute and read and write
15F0000
heap
page read and write
400000
unkown
page readonly
2803000
trusted library allocation
page read and write
61A0000
trusted library allocation
page execute and read and write
3E47000
heap
page read and write
994000
heap
page read and write
4630000
direct allocation
page read and write
2502000
trusted library allocation
page read and write
AD0000
heap
page read and write
3E90000
heap
page read and write
163E000
stack
page read and write
5C7000
stack
page read and write
2480000
heap
page read and write
24F2000
trusted library allocation
page read and write
9A0000
heap
page read and write
4C12000
trusted library allocation
page read and write
4C0D000
trusted library allocation
page read and write
93D000
heap
page read and write
4C06000
trusted library allocation
page read and write
3E64000
heap
page read and write
3ED8000
heap
page read and write
603F000
stack
page read and write
2807000
trusted library allocation
page read and write
5186000
trusted library allocation
page read and write
3E13000
heap
page read and write
401000
unkown
page execute read
62B0000
trusted library allocation
page execute and read and write
3D1D000
heap
page read and write
45B3000
direct allocation
page read and write
5000000
trusted library allocation
page read and write
482000
unkown
page readonly
840000
heap
page read and write
45B3000
direct allocation
page read and write
26F0000
heap
page execute and read and write
2876000
trusted library allocation
page read and write
2500000
trusted library allocation
page read and write
5E7E000
stack
page read and write
475D000
direct allocation
page read and write
858000
heap
page read and write
96E000
heap
page read and write
3729000
trusted library allocation
page read and write
5CFE000
stack
page read and write
491000
unkown
page write copy
2580000
heap
page read and write
3DA8000
heap
page read and write
3B90000
heap
page read and write
3CD6000
heap
page read and write
3C0B000
heap
page read and write
3F18000
heap
page execute and read and write
3EA4000
heap
page read and write
61D0000
trusted library allocation
page read and write
991000
heap
page read and write
A70000
heap
page read and write
3F19000
heap
page read and write
45B3000
direct allocation
page read and write
24D3000
trusted library allocation
page execute and read and write
401000
unkown
page execute read
4CA000
stack
page read and write
47CE000
direct allocation
page read and write
434D000
heap
page read and write
26CE000
stack
page read and write
490000
unkown
page read and write
475D000
direct allocation
page read and write
3E7B000
heap
page read and write
16E0000
heap
page read and write
3040000
heap
page read and write
400000
unkown
page readonly
4C01000
trusted library allocation
page read and write
617E000
stack
page read and write
45B3000
direct allocation
page read and write
379A000
trusted library allocation
page read and write
5BFE000
stack
page read and write
24E0000
trusted library allocation
page read and write
27F6000
trusted library allocation
page read and write
120000
heap
page read and write
27AB000
trusted library allocation
page read and write
15D0000
heap
page read and write
6260000
heap
page read and write
5D57000
heap
page read and write
28C0000
trusted library allocation
page read and write
4BE6000
trusted library allocation
page read and write
2956000
trusted library allocation
page read and write
475D000
direct allocation
page read and write
27BC000
trusted library allocation
page read and write
43F4000
heap
page read and write
4759000
direct allocation
page read and write
86E000
heap
page read and write
15BE000
stack
page read and write
3DE2000
heap
page read and write
47CE000
direct allocation
page read and write
24C0000
trusted library allocation
page read and write
24D0000
trusted library allocation
page read and write
2991000
trusted library allocation
page read and write
4C30000
trusted library allocation
page read and write
489E000
stack
page read and write
297E000
trusted library allocation
page read and write
378E000
trusted library allocation
page read and write
256E000
stack
page read and write
110000
heap
page read and write
502E000
trusted library allocation
page read and write
A60000
heap
page read and write
5D00000
heap
page read and write
28B2000
trusted library allocation
page read and write
28AD000
trusted library allocation
page read and write
4AB000
unkown
page readonly
24D4000
trusted library allocation
page read and write
475D000
direct allocation
page read and write
26E3000
heap
page read and write
100000
heap
page read and write
2E94000
heap
page read and write
4630000
direct allocation
page read and write
5FFE000
stack
page read and write
61C0000
trusted library allocation
page read and write
15F5000
heap
page read and write
115E000
stack
page read and write
619F000
trusted library allocation
page read and write
47CE000
direct allocation
page read and write
3B91000
heap
page read and write
5FBE000
stack
page read and write
3F1C000
heap
page read and write
4D80000
heap
page read and write
2847000
trusted library allocation
page read and write
ABE000
stack
page read and write
3F28000
heap
page read and write
607E000
stack
page read and write
47CE000
direct allocation
page read and write
482000
unkown
page readonly
3E9A000
heap
page read and write
284F000
trusted library allocation
page read and write
There are 253 hidden memdumps, click here to show them.