IOC Report
Documents.exe

loading gif

Files

File Path
Type
Category
Malicious
Documents.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\BjTxJte.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\obtenebrate
data
dropped
C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
modified
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Documents.exe
"C:\Users\user\Desktop\Documents.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\Documents.exe"
 malicious
C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
malicious
C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe
"C:\Users\user\AppData\Roaming\BjTxJte\BjTxJte.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://api.ipify.org/
unknown
https://api.ipify.org
unknown
http://r10.o.lencr.org0#
unknown
https://account.dyn.com/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://mail.starmech.net
unknown
http://r10.i.lencr.org/0W
unknown

Domains

Name
IP
Malicious
mail.starmech.net
207.174.215.249
 malicious
api.ipify.org
104.26.13.205

IPs

IP
Domain
Country
Malicious
207.174.215.249
mail.starmech.net
United States
malicious
104.26.13.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
BjTxJte
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
275D000
trusted library allocation
page read and write
 malicious
2784000
trusted library allocation
page read and write
 malicious
4300000
direct allocation
page read and write
 malicious
782000
system
page execute and read and write
 malicious
3F49000
heap
page read and write
4CBE000
stack
page read and write
B28000
heap
page read and write
735E000
stack
page read and write
501E000
stack
page read and write
65A000
stack
page read and write
60DC000
stack
page read and write
3F5A000
heap
page read and write
4660000
direct allocation
page read and write
2E81000
trusted library allocation
page read and write
3F4A000
heap
page read and write
609D000
trusted library allocation
page read and write
6110000
trusted library allocation
page execute and read and write
1270000
trusted library allocation
page read and write
4789000
direct allocation
page read and write
F68000
heap
page read and write
554E000
stack
page read and write
3F4A000
heap
page read and write
89F000
stack
page read and write
A88000
heap
page read and write
A05000
trusted library allocation
page execute and read and write
529E000
stack
page read and write
3F90000
heap
page read and write
5A7B000
unkown
page read and write
2E70000
heap
page execute and read and write
B3F000
heap
page read and write
52C0000
heap
page read and write
3E02000
heap
page read and write
28C0000
trusted library allocation
page execute and read and write
2800000
trusted library allocation
page read and write
3F90000
heap
page read and write
4EDC000
stack
page read and write
A30000
heap
page read and write
C6E000
stack
page read and write
45E3000
direct allocation
page read and write
490000
unkown
page read and write
3F90000
heap
page read and write
3F90000
heap
page read and write
745F000
stack
page read and write
3F00000
heap
page read and write
EE0000
trusted library allocation
page read and write
B3C000
stack
page read and write
44C0000
direct allocation
page read and write
45E3000
direct allocation
page read and write
3F4A000
heap
page read and write
2DF0000
trusted library allocation
page read and write
542000
unkown
page readonly
9DD000
trusted library allocation
page execute and read and write
100000
heap
page read and write
3EE4000
heap
page execute and read and write
54A000
unkown
page readonly
4EA0000
heap
page execute and read and write
12E0000
trusted library allocation
page read and write
2E0E000
stack
page read and write
3774000
trusted library allocation
page read and write
47FE000
direct allocation
page read and write
3F4A000
heap
page read and write
3F90000
heap
page read and write
8B4000
stack
page read and write
4C00000
trusted library allocation
page read and write
3F4A000
heap
page read and write
3F90000
heap
page read and write
6100000
trusted library allocation
page read and write
540000
unkown
page readonly
44C0000
direct allocation
page read and write
A2F000
heap
page read and write
3F90000
heap
page read and write
3F4A000
heap
page read and write
850000
heap
page read and write
E1F000
stack
page read and write
3E90000
heap
page read and write
2DEC000
stack
page read and write
5AD0000
trusted library allocation
page read and write
5C40000
heap
page read and write
401000
unkown
page execute read
4789000
direct allocation
page read and write
621C000
stack
page read and write
9F2000
trusted library allocation
page read and write
122F000
stack
page read and write
3F90000
heap
page read and write
5DC000
stack
page read and write
3F90000
heap
page read and write
63BC000
stack
page read and write
3F90000
heap
page read and write
3F4A000
heap
page read and write
558E000
stack
page read and write
860000
heap
page read and write
45E3000
direct allocation
page read and write
5C3E000
stack
page read and write
2CF0000
trusted library allocation
page read and write
A18000
heap
page read and write
47FE000
direct allocation
page read and write
3DA9000
heap
page read and write
3F4A000
heap
page read and write
3F01000
heap
page read and write
4C5C000
stack
page read and write
48AE000
stack
page read and write
A02000
trusted library allocation
page read and write
12CB000
trusted library allocation
page execute and read and write
12C7000
trusted library allocation
page execute and read and write
28E1000
trusted library allocation
page read and write
1290000
trusted library allocation
page read and write
93E000
stack
page read and write
CC0000
trusted library allocation
page execute and read and write
478D000
direct allocation
page read and write
13FF000
stack
page read and write
3F4A000
heap
page read and write
B85000
heap
page read and write
3FC5000
heap
page read and write
F10000
heap
page read and write
9BE000
stack
page read and write
84E000
stack
page read and write
6350000
heap
page read and write
C34000
trusted library allocation
page read and write
3DA5000
heap
page read and write
4DD4000
heap
page read and write
A9E000
stack
page read and write
401000
unkown
page execute read
3E65000
heap
page read and write
400000
unkown
page readonly
7BE000
system
page execute and read and write
F60000
heap
page read and write
49DE000
stack
page read and write
60F0000
trusted library allocation
page read and write
52B0000
trusted library allocation
page read and write
BB0000
heap
page read and write
4AB000
unkown
page readonly
50AE000
stack
page read and write
44C0000
direct allocation
page read and write
607E000
stack
page read and write
3F4A000
heap
page read and write
B4B000
heap
page read and write
C57000
trusted library allocation
page execute and read and write
BFE000
stack
page read and write
44C0000
direct allocation
page read and write
3A7D000
heap
page read and write
3F4A000
heap
page read and write
8F9000
stack
page read and write
4303000
heap
page read and write
1E0000
heap
page read and write
5F80000
heap
page read and write
4FDE000
stack
page read and write
482000
unkown
page readonly
3F90000
heap
page read and write
866000
heap
page read and write
478D000
direct allocation
page read and write
1230000
heap
page read and write
A8E000
heap
page read and write
3D9E000
heap
page read and write
2CDE000
stack
page read and write
9E0000
trusted library allocation
page read and write
ADE000
stack
page read and write
4AB000
unkown
page readonly
26C0000
trusted library allocation
page read and write
536E000
stack
page read and write
C24000
trusted library allocation
page read and write
AE0000
heap
page read and write
800000
heap
page read and write
AE9000
heap
page read and write
5A3E000
stack
page read and write
B10000
trusted library allocation
page read and write
3F4A000
heap
page read and write
45E3000
direct allocation
page read and write
3F88000
heap
page read and write
DEE000
stack
page read and write
3C67000
heap
page read and write
3F01000
heap
page read and write
B58000
heap
page read and write
3C86000
heap
page read and write
ED0000
trusted library allocation
page read and write
3F90000
heap
page read and write
780000
system
page execute and read and write
C23000
trusted library allocation
page execute and read and write
3DAE000
heap
page read and write
4FAE000
stack
page read and write
12B0000
heap
page read and write
44C0000
direct allocation
page read and write
603E000
stack
page read and write
3F90000
heap
page read and write
47FE000
direct allocation
page read and write
515D000
stack
page read and write
62B0000
trusted library allocation
page read and write
A4C000
heap
page read and write
1284000
trusted library allocation
page read and write
3BF0000
heap
page read and write
4660000
direct allocation
page read and write
3F90000
heap
page read and write
52E0000
heap
page read and write
9D4000
trusted library allocation
page read and write
3F4A000
heap
page read and write
8A0000
heap
page read and write
3F90000
heap
page read and write
3F90000
heap
page read and write
60E0000
trusted library allocation
page read and write
3EEE000
heap
page read and write
28BE000
stack
page read and write
6920000
trusted library allocation
page read and write
3E81000
trusted library allocation
page read and write
C30000
trusted library allocation
page read and write
A50000
heap
page read and write
47FE000
direct allocation
page read and write
2792000
trusted library allocation
page read and write
8AF000
stack
page read and write
45E3000
direct allocation
page read and write
44C0000
direct allocation
page read and write
3DA7000
heap
page read and write
3F4A000
heap
page read and write
A10000
heap
page read and write
2E10000
heap
page read and write
122E000
stack
page read and write
759000
stack
page read and write
670C000
stack
page read and write
7820000
heap
page read and write
C5B000
trusted library allocation
page execute and read and write
F96000
heap
page read and write
5F7E000
stack
page read and write
CE7000
heap
page read and write
490000
unkown
page write copy
4660000
direct allocation
page read and write
5B00000
heap
page read and write
CC0000
heap
page execute and read and write
A20000
heap
page read and write
990000
heap
page read and write
5CD8000
heap
page read and write
8FE000
stack
page read and write
9D3000
trusted library allocation
page execute and read and write
5ABB000
stack
page read and write
3F90000
heap
page read and write
4DFE000
stack
page read and write
44C0000
direct allocation
page read and write
3F90000
heap
page read and write
60F6000
trusted library allocation
page read and write
3E78000
heap
page read and write
3F4A000
heap
page read and write
9F0000
trusted library allocation
page read and write
9A000
stack
page read and write
B8F000
heap
page read and write
532E000
stack
page read and write
478D000
direct allocation
page read and write
C2D000
trusted library allocation
page execute and read and write
C70000
heap
page execute and read and write
5B0A000
heap
page read and write
6340000
trusted library allocation
page execute and read and write
7F730000
trusted library allocation
page execute and read and write
3F4A000
heap
page read and write
1294000
trusted library allocation
page read and write
4DD0000
heap
page read and write
6710000
heap
page read and write
9F6000
trusted library allocation
page execute and read and write
62A0000
trusted library allocation
page execute and read and write
4660000
direct allocation
page read and write
4E3E000
stack
page read and write
9FE000
stack
page read and write
4789000
direct allocation
page read and write
9ED000
trusted library allocation
page execute and read and write
9D0000
trusted library allocation
page read and write
9FA000
trusted library allocation
page execute and read and write
A3A000
heap
page read and write
3711000
trusted library allocation
page read and write
12C0000
trusted library allocation
page read and write
6090000
trusted library allocation
page read and write
3739000
trusted library allocation
page read and write
3F4A000
heap
page read and write
544E000
stack
page read and write
1283000
trusted library allocation
page execute and read and write
3F90000
heap
page read and write
C0E000
stack
page read and write
51AF000
stack
page read and write
4F7E000
stack
page read and write
478D000
direct allocation
page read and write
4789000
direct allocation
page read and write
3E27000
heap
page read and write
CE0000
heap
page read and write
3F90000
heap
page read and write
478D000
direct allocation
page read and write
960000
heap
page read and write
3F90000
heap
page read and write
8A5000
heap
page read and write
26B0000
trusted library allocation
page read and write
55D0000
heap
page execute and read and write
43BF000
heap
page read and write
56DE000
stack
page read and write
47FE000
direct allocation
page read and write
2700000
heap
page read and write
759E000
stack
page read and write
A20000
heap
page read and write
26DE000
trusted library allocation
page read and write
27F3000
trusted library allocation
page read and write
B44000
heap
page read and write
3F4A000
heap
page read and write
3F90000
heap
page read and write
3F90000
heap
page read and write
26D2000
trusted library allocation
page read and write
47FE000
direct allocation
page read and write
27F7000
trusted library allocation
page read and write
B80000
heap
page read and write
38E1000
trusted library allocation
page read and write
3F4A000
heap
page read and write
F8A000
heap
page read and write
53E0000
trusted library allocation
page execute and read and write
A4F000
heap
page read and write
2D00000
heap
page read and write
3F4A000
heap
page read and write
3794000
trusted library allocation
page read and write
2711000
trusted library allocation
page read and write
D10000
heap
page read and write
4789000
direct allocation
page read and write
4789000
direct allocation
page read and write
2747000
trusted library allocation
page read and write
101E000
stack
page read and write
3EE5000
heap
page read and write
CBE000
stack
page read and write
26CE000
trusted library allocation
page read and write
6088000
trusted library allocation
page read and write
366E000
stack
page read and write
A0B000
trusted library allocation
page execute and read and write
3F4A000
heap
page read and write
4A7000
unkown
page read and write
2F20000
heap
page read and write
47FE000
direct allocation
page read and write
4BF0000
trusted library allocation
page read and write
26ED000
trusted library allocation
page read and write
60E7000
trusted library allocation
page read and write
129D000
trusted library allocation
page execute and read and write
2CE0000
trusted library allocation
page execute and read and write
12F0000
heap
page read and write
3F4A000
heap
page read and write
4789000
direct allocation
page read and write
625E000
stack
page read and write
400000
unkown
page readonly
3F4A000
heap
page read and write
A55000
heap
page read and write
45E3000
direct allocation
page read and write
3A6F000
stack
page read and write
3CF0000
heap
page read and write
86B000
heap
page read and write
9C0000
trusted library allocation
page read and write
AE1000
heap
page read and write
62BB000
trusted library allocation
page read and write
26E6000
trusted library allocation
page read and write
55CE000
stack
page read and write
3F90000
heap
page read and write
4660000
direct allocation
page read and write
3F4A000
heap
page read and write
3ECC000
heap
page read and write
57DF000
stack
page read and write
3BF1000
heap
page read and write
3F90000
heap
page read and write
5C57000
heap
page read and write
2E20000
heap
page read and write
3F4A000
heap
page read and write
128D000
trusted library allocation
page execute and read and write
F4E000
stack
page read and write
3F4A000
heap
page read and write
3F90000
heap
page read and write
940000
heap
page read and write
45E3000
direct allocation
page read and write
3F90000
heap
page read and write
3F4A000
heap
page read and write
964000
heap
page read and write
3F4A000
heap
page read and write
5C5A000
heap
page read and write
A6A000
heap
page read and write
4660000
direct allocation
page read and write
6080000
trusted library allocation
page read and write
4CC0000
heap
page execute and read and write
CBC000
stack
page read and write
26CB000
trusted library allocation
page read and write
4660000
direct allocation
page read and write
278C000
trusted library allocation
page read and write
3F90000
heap
page read and write
2BDE000
stack
page read and write
F84000
heap
page read and write
3F4A000
heap
page read and write
3F90000
heap
page read and write
A07000
trusted library allocation
page execute and read and write
482000
unkown
page readonly
3F4A000
heap
page read and write
3EA3000
heap
page read and write
3DA0000
heap
page read and write
940000
heap
page read and write
EC0000
trusted library allocation
page execute and read and write
478D000
direct allocation
page read and write
3EF0000
heap
page read and write
4CD0000
heap
page read and write
5AC0000
trusted library allocation
page execute and read and write
28D0000
heap
page read and write
3EE9000
heap
page read and write
629E000
stack
page read and write
7830000
heap
page read and write
26F2000
trusted library allocation
page read and write
9A0000
heap
page read and write
52C0000
trusted library allocation
page read and write
3F90000
heap
page read and write
3DB2000
heap
page read and write
A3E000
heap
page read and write
EF9000
stack
page read and write
4718000
trusted library allocation
page read and write
4E7E000
stack
page read and write
F7F000
heap
page read and write
AFC000
heap
page read and write
62E0000
trusted library allocation
page read and write
3F4A000
heap
page read and write
2690000
heap
page read and write
A25000
heap
page read and write
AE4000
heap
page read and write
CD0000
trusted library allocation
page read and write
C3D000
trusted library allocation
page execute and read and write
3F90000
heap
page read and write
D0C000
stack
page read and write
3F90000
heap
page read and write
B20000
heap
page read and write
26E1000
trusted library allocation
page read and write
3F4A000
heap
page read and write
3F90000
heap
page read and write
AA3000
heap
page read and write
3F4A000
heap
page read and write
FD9000
heap
page read and write
27E6000
trusted library allocation
page read and write
2F25000
heap
page read and write
511E000
stack
page read and write
691D000
stack
page read and write
F00000
heap
page read and write
268F000
stack
page read and write
478D000
direct allocation
page read and write
C20000
trusted library allocation
page read and write
162F000
stack
page read and write
525E000
stack
page read and write
749E000
stack
page read and write
681D000
stack
page read and write
3F4A000
heap
page read and write
There are 425 hidden memdumps, click here to show them.