Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Purchase Order.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\Roca
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Purchase Order.exe
|
"C:\Users\user\Desktop\Purchase Order.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\Purchase Order.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://api.telegram.org
|
unknown
|
|
|
|
https://api.telegram.org/bot
|
unknown
|
|
|
|
http://checkip.dyndns.org/
|
193.122.6.168
|
||
|
https://api.telegram.org/bot7875791011:AAE04KxIyEpkKPdll3baXne01itunMyk28Y/sendDocument?chat_id=8177481203&caption=user%20/%20Passwords%20/%20173.254.250.71
|
149.154.167.220
|
||
|
http://checkip.dyndns.org/q
|
unknown
|
||
|
http://reallyfreegeoip.org
|
unknown
|
||
|
https://reallyfreegeoip.org
|
unknown
|
||
|
https://reallyfreegeoip.org/xml/173.254.250.71
|
188.114.97.3
|
||
|
https://api.telegram.org/bot7875791011:AAE04KxIyEpkKPdll3baXne01itunMyk28Y/sendDocument?chat_id=8177
|
unknown
|
||
|
http://checkip.dyndns.org
|
unknown
|
||
|
http://checkip.dyndns.com
|
unknown
|
||
|
http://api.telegram.org
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
https://api.telegram.org/bot-/sendDocument?chat_id=
|
unknown
|
||
|
https://reallyfreegeoip.org/xml/
|
unknown
|
There are 5 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
reallyfreegeoip.org
|
188.114.97.3
|
|
|
|
api.telegram.org
|
149.154.167.220
|
|
|
|
checkip.dyndns.org
|
unknown
|
|
|
|
171.39.242.20.in-addr.arpa
|
unknown
|
|
|
|
212.20.149.52.in-addr.arpa
|
unknown
|
|
|
|
checkip.dyndns.com
|
193.122.6.168
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
149.154.167.220
|
api.telegram.org
|
United Kingdom
|
|
|
|
188.114.97.3
|
reallyfreegeoip.org
|
European Union
|
|
|
|
193.122.6.168
|
checkip.dyndns.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
402000
|
system
|
page execute and read and write
|
|
|
|
1770000
|
direct allocation
|
page read and write
|
|
|
|
32BB000
|
trusted library allocation
|
page read and write
|
|
|
|
5A70000
|
heap
|
page execute and read and write
|
||
|
13B0000
|
heap
|
page read and write
|
||
|
460E000
|
direct allocation
|
page read and write
|
||
|
1706000
|
trusted library allocation
|
page execute and read and write
|
||
|
6870000
|
trusted library allocation
|
page execute and read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
4470000
|
direct allocation
|
page read and write
|
||
|
423F000
|
trusted library allocation
|
page read and write
|
||
|
459D000
|
direct allocation
|
page read and write
|
||
|
43F3000
|
direct allocation
|
page read and write
|
||
|
3DC0000
|
heap
|
page read and write
|
||
|
155F000
|
heap
|
page read and write
|
||
|
16E3000
|
trusted library allocation
|
page execute and read and write
|
||
|
171B000
|
trusted library allocation
|
page execute and read and write
|
||
|
3E4A000
|
heap
|
page read and write
|
||
|
66EF000
|
stack
|
page read and write
|
||
|
42D0000
|
direct allocation
|
page read and write
|
||
|
3C4F000
|
stack
|
page read and write
|
||
|
4AB000
|
unkown
|
page readonly
|
||
|
15C9000
|
heap
|
page read and write
|
||
|
6DE0000
|
trusted library allocation
|
page execute and read and write
|
||
|
FFA000
|
stack
|
page read and write
|
||
|
3D4F000
|
heap
|
page read and write
|
||
|
3E36000
|
heap
|
page read and write
|
||
|
572E000
|
trusted library allocation
|
page read and write
|
||
|
14E0000
|
heap
|
page read and write
|
||
|
66F0000
|
heap
|
page read and write
|
||
|
43F3000
|
direct allocation
|
page read and write
|
||
|
3E46000
|
heap
|
page execute and read and write
|
||
|
8FE000
|
stack
|
page read and write
|
||
|
3204000
|
trusted library allocation
|
page read and write
|
||
|
5722000
|
trusted library allocation
|
page read and write
|
||
|
568E000
|
stack
|
page read and write
|
||
|
6DC8000
|
trusted library allocation
|
page read and write
|
||
|
3248000
|
trusted library allocation
|
page read and write
|
||
|
3294000
|
trusted library allocation
|
page read and write
|
||
|
32A8000
|
trusted library allocation
|
page read and write
|
||
|
564E000
|
stack
|
page read and write
|
||
|
A70000
|
heap
|
page read and write
|
||
|
384E000
|
stack
|
page read and write
|
||
|
1702000
|
trusted library allocation
|
page read and write
|
||
|
316E000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
6B5E000
|
stack
|
page read and write
|
||
|
3F48000
|
heap
|
page read and write
|
||
|
1E0000
|
heap
|
page read and write
|
||
|
3C50000
|
heap
|
page read and write
|
||
|
57ED000
|
stack
|
page read and write
|
||
|
705E000
|
stack
|
page read and write
|
||
|
4201000
|
trusted library allocation
|
page read and write
|
||
|
572A000
|
trusted library allocation
|
page read and write
|
||
|
100000
|
heap
|
page read and write
|
||
|
127E000
|
stack
|
page read and write
|
||
|
AAD000
|
heap
|
page read and write
|
||
|
4599000
|
direct allocation
|
page read and write
|
||
|
1710000
|
trusted library allocation
|
page read and write
|
||
|
16E0000
|
trusted library allocation
|
page read and write
|
||
|
9DE000
|
stack
|
page read and write
|
||
|
17E0000
|
heap
|
page read and write
|
||
|
43F3000
|
direct allocation
|
page read and write
|
||
|
715E000
|
stack
|
page read and write
|
||
|
459D000
|
direct allocation
|
page read and write
|
||
|
5710000
|
trusted library allocation
|
page read and write
|
||
|
3100000
|
heap
|
page read and write
|
||
|
67F3000
|
trusted library allocation
|
page read and write
|
||
|
686E000
|
stack
|
page read and write
|
||
|
4470000
|
direct allocation
|
page read and write
|
||
|
56CE000
|
stack
|
page read and write
|
||
|
6E20000
|
heap
|
page read and write
|
||
|
571B000
|
trusted library allocation
|
page read and write
|
||
|
42D0000
|
direct allocation
|
page read and write
|
||
|
3D0F000
|
heap
|
page read and write
|
||
|
6DC1000
|
trusted library allocation
|
page read and write
|
||
|
89F000
|
stack
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
636E000
|
stack
|
page read and write
|
||
|
5716000
|
trusted library allocation
|
page read and write
|
||
|
6DD0000
|
trusted library allocation
|
page read and write
|
||
|
5780000
|
trusted library allocation
|
page read and write
|
||
|
1712000
|
trusted library allocation
|
page read and write
|
||
|
7010000
|
heap
|
page read and write
|
||
|
3040000
|
heap
|
page read and write
|
||
|
460E000
|
direct allocation
|
page read and write
|
||
|
5731000
|
trusted library allocation
|
page read and write
|
||
|
5B7E000
|
stack
|
page read and write
|
||
|
14E8000
|
heap
|
page read and write
|
||
|
460E000
|
direct allocation
|
page read and write
|
||
|
4191000
|
trusted library allocation
|
page read and write
|
||
|
671E000
|
heap
|
page read and write
|
||
|
980000
|
heap
|
page read and write
|
||
|
178E000
|
stack
|
page read and write
|
||
|
17F0000
|
heap
|
page read and write
|
||
|
1715000
|
trusted library allocation
|
page execute and read and write
|
||
|
2F90000
|
heap
|
page read and write
|
||
|
673C000
|
heap
|
page read and write
|
||
|
3191000
|
trusted library allocation
|
page read and write
|
||
|
5800000
|
trusted library allocation
|
page read and write
|
||
|
1686000
|
heap
|
page read and write
|
||
|
A8E000
|
heap
|
page read and write
|
||
|
43F3000
|
direct allocation
|
page read and write
|
||
|
42D0000
|
direct allocation
|
page read and write
|
||
|
6810000
|
trusted library allocation
|
page execute and read and write
|
||
|
3D29000
|
heap
|
page read and write
|
||
|
43F3000
|
direct allocation
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
17D0000
|
heap
|
page read and write
|
||
|
4470000
|
direct allocation
|
page read and write
|
||
|
3232000
|
trusted library allocation
|
page read and write
|
||
|
3271000
|
trusted library allocation
|
page read and write
|
||
|
6DF0000
|
trusted library allocation
|
page read and write
|
||
|
3D4F000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
A8A000
|
heap
|
page read and write
|
||
|
320E000
|
trusted library allocation
|
page read and write
|
||
|
167F000
|
stack
|
page read and write
|
||
|
4599000
|
direct allocation
|
page read and write
|
||
|
65EE000
|
stack
|
page read and write
|
||
|
459D000
|
direct allocation
|
page read and write
|
||
|
460E000
|
direct allocation
|
page read and write
|
||
|
31F6000
|
trusted library allocation
|
page read and write
|
||
|
16F0000
|
trusted library allocation
|
page read and write
|
||
|
6806000
|
trusted library allocation
|
page read and write
|
||
|
1E5000
|
heap
|
page read and write
|
||
|
4A7000
|
unkown
|
page read and write
|
||
|
17E3000
|
heap
|
page read and write
|
||
|
42D0000
|
direct allocation
|
page read and write
|
||
|
17CD000
|
stack
|
page read and write
|
||
|
41C9000
|
trusted library allocation
|
page read and write
|
||
|
6A5E000
|
stack
|
page read and write
|
||
|
3286000
|
trusted library allocation
|
page read and write
|
||
|
323D000
|
trusted library allocation
|
page read and write
|
||
|
1509000
|
heap
|
page read and write
|
||
|
42D0000
|
direct allocation
|
page read and write
|
||
|
31F3000
|
trusted library allocation
|
page read and write
|
||
|
6820000
|
trusted library allocation
|
page execute and read and write
|
||
|
460E000
|
direct allocation
|
page read and write
|
||
|
680A000
|
trusted library allocation
|
page read and write
|
||
|
4470000
|
direct allocation
|
page read and write
|
||
|
3170000
|
trusted library allocation
|
page read and write
|
||
|
4599000
|
direct allocation
|
page read and write
|
||
|
43F3000
|
direct allocation
|
page read and write
|
||
|
159B000
|
heap
|
page read and write
|
||
|
459D000
|
direct allocation
|
page read and write
|
||
|
4470000
|
direct allocation
|
page read and write
|
||
|
336B000
|
trusted library allocation
|
page read and write
|
||
|
571E000
|
trusted library allocation
|
page read and write
|
||
|
33AD000
|
trusted library allocation
|
page read and write
|
||
|
5750000
|
trusted library allocation
|
page read and write
|
||
|
324C000
|
trusted library allocation
|
page read and write
|
||
|
5C7F000
|
stack
|
page read and write
|
||
|
5760000
|
trusted library allocation
|
page read and write
|
||
|
1516000
|
heap
|
page read and write
|
||
|
3180000
|
heap
|
page read and write
|
||
|
13B5000
|
heap
|
page read and write
|
||
|
573D000
|
trusted library allocation
|
page read and write
|
||
|
459D000
|
direct allocation
|
page read and write
|
||
|
5736000
|
trusted library allocation
|
page read and write
|
||
|
1717000
|
trusted library allocation
|
page execute and read and write
|
||
|
4AB000
|
unkown
|
page readonly
|
||
|
6804000
|
trusted library allocation
|
page read and write
|
||
|
4599000
|
direct allocation
|
page read and write
|
||
|
3298000
|
trusted library allocation
|
page read and write
|
||
|
ABC000
|
heap
|
page read and write
|
||
|
9A000
|
stack
|
page read and write
|
||
|
482000
|
unkown
|
page readonly
|
||
|
3254000
|
trusted library allocation
|
page read and write
|
||
|
6DB0000
|
trusted library allocation
|
page read and write
|
||
|
8B4000
|
stack
|
page read and write
|
||
|
3105000
|
heap
|
page read and write
|
||
|
68D0000
|
heap
|
page read and write
|
||
|
17D4000
|
heap
|
page read and write
|
||
|
14D0000
|
trusted library allocation
|
page read and write
|
||
|
4599000
|
direct allocation
|
page read and write
|
||
|
17E0000
|
heap
|
page read and write
|
||
|
1700000
|
trusted library allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
1740000
|
heap
|
page read and write
|
||
|
6A0E000
|
stack
|
page read and write
|
||
|
2FEA000
|
heap
|
page read and write
|
||
|
42D0000
|
direct allocation
|
page read and write
|
||
|
16ED000
|
trusted library allocation
|
page execute and read and write
|
||
|
8AF000
|
stack
|
page read and write
|
||
|
31FB000
|
trusted library allocation
|
page read and write
|
||
|
4470000
|
direct allocation
|
page read and write
|
||
|
32AE000
|
trusted library allocation
|
page read and write
|
||
|
3E27000
|
heap
|
page read and write
|
||
|
459D000
|
direct allocation
|
page read and write
|
||
|
1360000
|
heap
|
page read and write
|
||
|
3250000
|
trusted library allocation
|
page read and write
|
||
|
2FCB000
|
heap
|
page read and write
|
||
|
460E000
|
direct allocation
|
page read and write
|
||
|
33A8000
|
trusted library allocation
|
page read and write
|
||
|
16E4000
|
trusted library allocation
|
page read and write
|
||
|
A2E000
|
stack
|
page read and write
|
||
|
6732000
|
heap
|
page read and write
|
||
|
1490000
|
heap
|
page read and write
|
||
|
5742000
|
trusted library allocation
|
page read and write
|
||
|
67F0000
|
trusted library allocation
|
page read and write
|
||
|
4599000
|
direct allocation
|
page read and write
|
||
|
41B4000
|
trusted library allocation
|
page read and write
|
||
|
41BD000
|
trusted library allocation
|
page read and write
|
||
|
327C000
|
trusted library allocation
|
page read and write
|
||
|
3D41000
|
heap
|
page read and write
|
||
|
16FD000
|
trusted library allocation
|
page execute and read and write
|
||
|
12F7000
|
stack
|
page read and write
|
||
|
490000
|
unkown
|
page write copy
|
||
|
328F000
|
trusted library allocation
|
page read and write
|
||
|
3276000
|
trusted library allocation
|
page read and write
|
||
|
482000
|
unkown
|
page readonly
|
||
|
A80000
|
heap
|
page read and write
|
||
|
93E000
|
stack
|
page read and write
|
||
|
16DE000
|
stack
|
page read and write
|
||
|
528E000
|
stack
|
page read and write
|
||
|
3210000
|
trusted library allocation
|
page read and write
|
||
|
41A000
|
system
|
page execute and read and write
|
||
|
3ED0000
|
heap
|
page read and write
|
||
|
32B5000
|
trusted library allocation
|
page read and write
|
||
|
170A000
|
trusted library allocation
|
page execute and read and write
|
||
|
17D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
560E000
|
stack
|
page read and write
|
||
|
1730000
|
trusted library allocation
|
page read and write
|
||
|
3060000
|
heap
|
page execute and read and write
|
||
|
3CE2000
|
heap
|
page read and write
|
||
|
490000
|
unkown
|
page read and write
|
||
|
13AE000
|
stack
|
page read and write
|
||
|
950000
|
heap
|
page read and write
|
There are 219 hidden memdumps, click here to show them.