IOC Report
WINNING DILIGENCE - VESSEL PARTICULARS.doc.exe

loading gif

Files

File Path
Type
Category
Malicious
WINNING DILIGENCE - VESSEL PARTICULARS.doc.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\recomplete
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\WINNING DILIGENCE - VESSEL PARTICULARS.doc.exe
"C:\Users\user\Desktop\WINNING DILIGENCE - VESSEL PARTICULARS.doc.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\WINNING DILIGENCE - VESSEL PARTICULARS.doc.exe"
 malicious
C:\Users\user\Desktop\WINNING DILIGENCE - VESSEL PARTICULARS.doc.exe
"C:\Users\user\Desktop\WINNING DILIGENCE - VESSEL PARTICULARS.doc.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\WINNING DILIGENCE - VESSEL PARTICULARS.doc.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.13.205
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://beirutrest.com
unknown

Domains

Name
IP
Malicious
beirutrest.com
50.87.144.157
 malicious
api.ipify.org
unknown

IPs

IP
Domain
Country
Malicious
50.87.144.157
beirutrest.com
United States
malicious
104.26.13.205
unknown
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
312F000
trusted library allocation
page read and write
 malicious
54F0000
trusted library section
page read and write
 malicious
2AFE000
heap
page read and write
 malicious
40B1000
trusted library allocation
page read and write
 malicious
2FF0000
trusted library section
page read and write
 malicious
3104000
trusted library allocation
page read and write
 malicious
3040000
trusted library allocation
page read and write
15E000
stack
page read and write
93E000
stack
page read and write
482000
unkown
page readonly
3EC5000
heap
page execute and read and write
2E90000
trusted library allocation
page read and write
3DDB000
heap
page read and write
4510000
direct allocation
page read and write
1026000
heap
page read and write
68E8000
trusted library allocation
page read and write
2B70000
heap
page read and write
29EF000
heap
page read and write
2E80000
heap
page read and write
400000
unkown
page readonly
100000
heap
page read and write
E00000
heap
page read and write
3B10000
direct allocation
page read and write
484E000
direct allocation
page read and write
2A80000
trusted library allocation
page read and write
4633000
direct allocation
page read and write
3DAB000
heap
page read and write
482000
unkown
page readonly
9A000
stack
page read and write
3DB5000
heap
page read and write
2A8A000
trusted library allocation
page execute and read and write
4510000
direct allocation
page read and write
3061000
trusted library allocation
page read and write
484E000
direct allocation
page read and write
71DE000
stack
page read and write
490000
unkown
page read and write
A2A000
heap
page read and write
41B4000
trusted library allocation
page read and write
3046000
trusted library allocation
page read and write
43B7000
heap
page read and write
2BAD000
heap
page read and write
9FE000
heap
page read and write
47D9000
direct allocation
page read and write
305E000
trusted library allocation
page read and write
3EC9000
heap
page read and write
3E00000
heap
page read and write
46B0000
direct allocation
page read and write
401000
unkown
page execute read
304B000
trusted library allocation
page read and write
13C0000
heap
page read and write
106A000
heap
page read and write
359E000
stack
page read and write
2E70000
heap
page execute and read and write
3F4F000
heap
page read and write
444000
system
page execute and read and write
5A90000
trusted library allocation
page read and write
3072000
trusted library allocation
page read and write
400000
unkown
page readonly
3B19000
heap
page read and write
FEF000
heap
page read and write
9F0000
heap
page read and write
30A0000
heap
page read and write
46B0000
direct allocation
page read and write
484E000
direct allocation
page read and write
58AC000
heap
page read and write
4663000
direct allocation
page read and write
47D9000
direct allocation
page read and write
9CE000
stack
page read and write
3DC1000
heap
page read and write
3BE0000
heap
page read and write
4633000
direct allocation
page read and write
11EF000
stack
page read and write
4510000
direct allocation
page read and write
110000
heap
page read and write
57D0000
heap
page read and write
1F4000
heap
page read and write
30B1000
trusted library allocation
page read and write
4AB000
unkown
page readonly
3D90000
heap
page read and write
64E0000
trusted library allocation
page execute and read and write
F90000
trusted library section
page read and write
2A73000
trusted library allocation
page read and write
FB0000
trusted library allocation
page read and write
3EE1000
heap
page read and write
68F0000
trusted library allocation
page read and write
2FEE000
stack
page read and write
484E000
direct allocation
page read and write
2CA0000
heap
page read and write
2EA3000
heap
page read and write
3DF1000
heap
page read and write
2D60000
heap
page read and write
3052000
trusted library allocation
page read and write
47D9000
direct allocation
page read and write
401000
unkown
page execute read
4633000
direct allocation
page read and write
400000
unkown
page readonly
1F0000
heap
page read and write
1C0000
heap
page read and write
11BE000
stack
page read and write
47DD000
direct allocation
page read and write
312B000
trusted library allocation
page read and write
2A9B000
trusted library allocation
page execute and read and write
47D9000
direct allocation
page read and write
2A5E000
stack
page read and write
304E000
trusted library allocation
page read and write
54EE000
stack
page read and write
3D5E000
heap
page read and write
2E55000
heap
page read and write
2A82000
trusted library allocation
page read and write
2E60000
trusted library allocation
page read and write
7F640000
trusted library allocation
page execute and read and write
982000
heap
page read and write
3EB0000
heap
page read and write
6E70000
trusted library allocation
page read and write
4510000
direct allocation
page read and write
46B0000
direct allocation
page read and write
3E8A000
heap
page read and write
401000
unkown
page execute read
14E000
stack
page read and write
480D000
direct allocation
page read and write
FC8000
heap
page read and write
F40000
heap
page read and write
2B90000
heap
page read and write
306D000
trusted library allocation
page read and write
170000
heap
page read and write
695D000
stack
page read and write
2B95000
heap
page read and write
70DE000
stack
page read and write
5A9D000
trusted library allocation
page read and write
666D000
stack
page read and write
3E99000
heap
page execute and read and write
6EC0000
heap
page read and write
399F000
stack
page read and write
6A2E000
stack
page read and write
490000
unkown
page write copy
484E000
direct allocation
page read and write
2E10000
heap
page read and write
480D000
direct allocation
page read and write
6A37000
trusted library allocation
page read and write
3F85000
heap
page read and write
3100000
trusted library allocation
page read and write
487E000
direct allocation
page read and write
4AB000
unkown
page readonly
3DD2000
heap
page read and write
2AD0000
heap
page read and write
3CAF000
stack
page read and write
3DA3000
heap
page read and write
2A86000
trusted library allocation
page execute and read and write
9FA000
heap
page read and write
68AE000
stack
page read and write
400000
unkown
page readonly
3DAD000
heap
page read and write
4510000
direct allocation
page read and write
6900000
trusted library allocation
page execute and read and write
FA0000
trusted library section
page read and write
5550000
trusted library allocation
page read and write
2BAD000
heap
page read and write
1037000
heap
page read and write
4633000
direct allocation
page read and write
958000
heap
page read and write
8B4000
stack
page read and write
2A95000
trusted library allocation
page execute and read and write
2CA7000
heap
page read and write
FF9000
heap
page read and write
3EE0000
heap
page read and write
57AC000
stack
page read and write
2DAE000
stack
page read and write
F45000
heap
page read and write
8FE000
stack
page read and write
47DD000
direct allocation
page read and write
1041000
heap
page read and write
5845000
heap
page read and write
3E12000
heap
page read and write
9A000
stack
page read and write
2A64000
trusted library allocation
page read and write
316F000
stack
page read and write
6CA0000
heap
page read and write
6C70000
heap
page read and write
2A92000
trusted library allocation
page read and write
42BC000
heap
page read and write
2DEE000
stack
page read and write
3F1F000
heap
page read and write
F1E000
stack
page read and write
3EB4000
heap
page read and write
3141000
trusted library allocation
page read and write
401000
unkown
page execute read
2D64000
heap
page read and write
A99000
stack
page read and write
30EA000
trusted library allocation
page read and write
305A000
trusted library allocation
page read and write
4510000
direct allocation
page read and write
38AE000
stack
page read and write
47DD000
direct allocation
page read and write
3D93000
heap
page read and write
3DBF000
heap
page read and write
FC0000
heap
page read and write
3E40000
heap
page read and write
4AB000
unkown
page readonly
426000
system
page execute and read and write
15EF000
stack
page read and write
121F000
stack
page read and write
2C70000
heap
page execute and read and write
5813000
heap
page read and write
2A63000
trusted library allocation
page execute and read and write
4809000
direct allocation
page read and write
2DB8000
trusted library allocation
page read and write
30F3000
trusted library allocation
page read and write
1DE000
stack
page read and write
67AE000
stack
page read and write
69EE000
stack
page read and write
150000
heap
page read and write
5570000
heap
page read and write
46B0000
direct allocation
page read and write
4540000
direct allocation
page read and write
3E2D000
heap
page read and write
F20000
heap
page read and write
3FB5000
heap
page read and write
46E0000
direct allocation
page read and write
2C80000
heap
page read and write
89F000
stack
page read and write
950000
heap
page read and write
31E8000
trusted library allocation
page read and write
6A30000
trusted library allocation
page read and write
2E50000
heap
page read and write
FFC000
heap
page read and write
3E88000
heap
page read and write
1A0000
heap
page read and write
56AC000
stack
page read and write
2FAE000
stack
page read and write
8AF000
stack
page read and write
8AF000
stack
page read and write
2EA0000
heap
page read and write
3DA6000
heap
page read and write
4A7000
unkown
page read and write
4633000
direct allocation
page read and write
2A7D000
trusted library allocation
page execute and read and write
2A97000
trusted library allocation
page execute and read and write
6E80000
trusted library allocation
page execute and read and write
47DD000
direct allocation
page read and write
42EA000
heap
page read and write
46B0000
direct allocation
page read and write
3D9D000
heap
page read and write
89F000
stack
page read and write
3CB0000
heap
page read and write
180000
heap
page read and write
3DE5000
heap
page read and write
3EE1000
heap
page read and write
482000
unkown
page readonly
3EB1000
heap
page read and write
68E0000
trusted library allocation
page read and write
3EAA000
heap
page read and write
F8E000
stack
page read and write
57D4000
heap
page read and write
3B41000
heap
page read and write
4540000
direct allocation
page read and write
1790000
heap
page read and write
8B4000
stack
page read and write
487E000
direct allocation
page read and write
6910000
trusted library allocation
page read and write
102A000
heap
page read and write
2A90000
trusted library allocation
page read and write
6A40000
trusted library allocation
page read and write
4AB000
unkown
page readonly
3135000
trusted library allocation
page read and write
3EB1000
heap
page read and write
3E9D000
heap
page read and write
490000
unkown
page read and write
2A60000
trusted library allocation
page read and write
6BEE000
stack
page read and write
3066000
trusted library allocation
page read and write
4809000
direct allocation
page read and write
2C5C000
stack
page read and write
3E4A000
heap
page read and write
2A70000
trusted library allocation
page read and write
39AA000
heap
page read and write
490000
unkown
page write copy
47DD000
direct allocation
page read and write
2C50000
heap
page read and write
6C6E000
stack
page read and write
43DF000
heap
page read and write
68F4000
trusted library allocation
page read and write
100000
heap
page read and write
47DD000
direct allocation
page read and write
2A6D000
trusted library allocation
page execute and read and write
46B0000
direct allocation
page read and write
4663000
direct allocation
page read and write
6C2E000
stack
page read and write
3CE0000
heap
page read and write
3D8A000
heap
page read and write
3EB6000
heap
page read and write
6E90000
heap
page read and write
4A7000
unkown
page read and write
B98000
stack
page read and write
2AC0000
trusted library allocation
page execute and read and write
4633000
direct allocation
page read and write
2C1E000
stack
page read and write
64D0000
heap
page read and write
47D9000
direct allocation
page read and write
47D9000
direct allocation
page read and write
19E000
stack
page read and write
2AB0000
trusted library allocation
page read and write
676F000
stack
page read and write
312D000
trusted library allocation
page read and write
3080000
trusted library allocation
page read and write
400000
system
page execute and read and write
46E0000
direct allocation
page read and write
2BA0000
direct allocation
page read and write
482000
unkown
page readonly
4172000
trusted library allocation
page read and write
2C60000
trusted library allocation
page read and write
484E000
direct allocation
page read and write
There are 301 hidden memdumps, click here to show them.