IOC Report
INVOICE.exe

loading gif

Files

File Path
Type
Category
Malicious
INVOICE.exe
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\aut15A9.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\spiketop
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\INVOICE.exe
"C:\Users\user\Desktop\INVOICE.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\INVOICE.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
172.67.74.152
https://api.ipify.org
unknown
http://crl.pki.goog/gsr1/gsr1.crl0;
unknown
http://o.pki.goog/wr20%
unknown
https://account.dyn.com/
unknown
http://c.pki.goog/r/r1.crl0
unknown
http://i.pki.goog/r1.crt0
unknown
http://c.pki.goog/wr2/GSyT1N4PBrg.crl0
unknown
http://pki.goog/gsr1/gsr1.crt02
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://smtp.gmail.com
unknown
http://i.pki.goog/wr2.crt0
unknown
There are 3 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
api.ipify.org
172.67.74.152
smtp.gmail.com
74.125.133.108

IPs

IP
Domain
Country
Malicious
74.125.133.108
smtp.gmail.com
United States
172.67.74.152
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2DF7000
trusted library allocation
page read and write
 malicious
3D8D000
trusted library allocation
page read and write
 malicious
2DEF000
trusted library allocation
page read and write
 malicious
2DC4000
trusted library allocation
page read and write
 malicious
5370000
trusted library section
page read and write
 malicious
2A90000
heap
page read and write
 malicious
53E0000
trusted library section
page read and write
 malicious
2FA3000
trusted library allocation
page read and write
3A2D000
direct allocation
page read and write
D10000
heap
page read and write
3A9E000
direct allocation
page read and write
2D6F000
stack
page read and write
3900000
direct allocation
page read and write
2A2E000
stack
page read and write
E60000
heap
page read and write
51B0000
heap
page read and write
DAC000
heap
page read and write
3374000
heap
page read and write
B3B000
unkown
page execute and read and write
39D9000
direct allocation
page read and write
66AE000
stack
page read and write
3370000
heap
page read and write
67F8000
trusted library allocation
page read and write
D2F000
heap
page read and write
7080000
heap
page read and write
685E000
stack
page read and write
A70000
unkown
page readonly
3A4E000
direct allocation
page read and write
2885000
trusted library allocation
page execute and read and write
98A000
stack
page read and write
36C0000
direct allocation
page read and write
2872000
trusted library allocation
page read and write
5222000
trusted library allocation
page read and write
38B0000
direct allocation
page read and write
EA4000
heap
page read and write
3900000
direct allocation
page read and write
EAC000
heap
page read and write
D46000
heap
page read and write
A70000
unkown
page readonly
A71000
unkown
page execute and read and write
D45000
heap
page read and write
6F20000
trusted library allocation
page execute and read and write
3E38000
trusted library allocation
page read and write
6CB0000
trusted library allocation
page execute and read and write
57A8000
heap
page read and write
9F0000
heap
page read and write
6EE0000
trusted library allocation
page read and write
D18000
heap
page read and write
2F98000
trusted library allocation
page read and write
2863000
trusted library allocation
page read and write
594D000
stack
page read and write
2DB1000
trusted library allocation
page read and write
536E000
stack
page read and write
3900000
direct allocation
page read and write
2F9E000
trusted library allocation
page read and write
3760000
direct allocation
page read and write
285D000
trusted library allocation
page execute and read and write
67AE000
stack
page read and write
3D71000
trusted library allocation
page read and write
3710000
direct allocation
page read and write
287A000
trusted library allocation
page execute and read and write
B44000
unkown
page execute and write copy
CB0000
heap
page read and write
39DD000
direct allocation
page read and write
DB9000
heap
page read and write
5746000
heap
page read and write
57BE000
heap
page read and write
2820000
trusted library section
page read and write
B9A000
unkown
page read and write
3883000
direct allocation
page read and write
2853000
trusted library allocation
page execute and read and write
E30000
heap
page read and write
3A29000
direct allocation
page read and write
6800000
trusted library allocation
page execute and read and write
A40000
heap
page read and write
2840000
trusted library allocation
page read and write
6810000
trusted library allocation
page read and write
D49000
heap
page read and write
67F0000
trusted library allocation
page read and write
523D000
trusted library allocation
page read and write
C2E000
stack
page read and write
2A40000
heap
page read and write
2C4C000
stack
page read and write
666F000
stack
page read and write
446000
system
page execute and read and write
5260000
heap
page execute and read and write
7F9A0000
trusted library allocation
page execute and read and write
2DBC000
trusted library allocation
page read and write
5970000
trusted library allocation
page execute and read and write
E20000
heap
page read and write
3A29000
direct allocation
page read and write
2F82000
trusted library allocation
page read and write
6EC7000
trusted library allocation
page read and write
522E000
trusted library allocation
page read and write
E8D000
heap
page read and write
3A2D000
direct allocation
page read and write
2854000
trusted library allocation
page read and write
B9A000
unkown
page write copy
2F93000
trusted library allocation
page read and write
2A67000
heap
page read and write
DBA000
heap
page read and write
521B000
trusted library allocation
page read and write
6ED0000
trusted library allocation
page read and write
DAB000
heap
page read and write
3A29000
direct allocation
page read and write
E38000
heap
page read and write
5210000
trusted library allocation
page read and write
DB9000
heap
page read and write
6EC0000
trusted library allocation
page read and write
56E8000
heap
page read and write
2E0B000
trusted library allocation
page read and write
2DEB000
trusted library allocation
page read and write
5216000
trusted library allocation
page read and write
56D0000
heap
page read and write
E63000
heap
page read and write
3E74000
trusted library allocation
page read and write
B93000
unkown
page execute and read and write
B99000
unkown
page execute and write copy
2F75000
trusted library allocation
page read and write
55AC000
stack
page read and write
D4A000
heap
page read and write
3710000
direct allocation
page read and write
DB9000
heap
page read and write
3883000
direct allocation
page read and write
2F84000
trusted library allocation
page read and write
ECB000
heap
page read and write
606D000
stack
page read and write
38B0000
direct allocation
page read and write
5450000
trusted library allocation
page read and write
400000
system
page execute and read and write
E6A000
heap
page read and write
5960000
heap
page read and write
602E000
stack
page read and write
EE1000
heap
page read and write
2A60000
heap
page read and write
28D0000
heap
page read and write
DB9000
heap
page read and write
DD5000
heap
page read and write
426000
system
page execute and read and write
3A4E000
direct allocation
page read and write
C6E000
stack
page read and write
6930000
heap
page read and write
2880000
trusted library allocation
page read and write
B2E000
unkown
page execute and read and write
521E000
trusted library allocation
page read and write
2C60000
heap
page read and write
2830000
trusted library section
page read and write
3D7D000
trusted library allocation
page read and write
67E0000
trusted library allocation
page read and write
590E000
stack
page read and write
2D71000
trusted library allocation
page read and write
2F46000
trusted library allocation
page read and write
38B0000
direct allocation
page read and write
5470000
heap
page read and write
5712000
heap
page read and write
286D000
trusted library allocation
page execute and read and write
3833000
direct allocation
page read and write
2DC0000
trusted library allocation
page read and write
2DED000
trusted library allocation
page read and write
3A4E000
direct allocation
page read and write
E64000
heap
page read and write
67E4000
trusted library allocation
page read and write
6CC0000
heap
page read and write
5236000
trusted library allocation
page read and write
28C0000
trusted library allocation
page read and write
3A9E000
direct allocation
page read and write
288B000
trusted library allocation
page execute and read and write
1AA0000
heap
page read and write
DAB000
heap
page read and write
2860000
trusted library allocation
page read and write
2DAA000
trusted library allocation
page read and write
E42000
heap
page read and write
2E02000
trusted library allocation
page read and write
2A43000
heap
page read and write
DD9000
heap
page read and write
2882000
trusted library allocation
page read and write
15DE000
stack
page read and write
39D9000
direct allocation
page read and write
6F40000
trusted library allocation
page read and write
3760000
direct allocation
page read and write
3A9E000
direct allocation
page read and write
2887000
trusted library allocation
page execute and read and write
3883000
direct allocation
page read and write
3D9000
stack
page read and write
E6D000
heap
page read and write
9FC000
stack
page read and write
3833000
direct allocation
page read and write
5231000
trusted library allocation
page read and write
595D000
trusted library allocation
page read and write
CD0000
heap
page read and write
19DE000
stack
page read and write
520E000
stack
page read and write
DD0000
heap
page read and write
6F10000
heap
page read and write
2C50000
trusted library allocation
page read and write
3A2D000
direct allocation
page read and write
656E000
stack
page read and write
E5F000
heap
page read and write
2850000
trusted library allocation
page read and write
3710000
direct allocation
page read and write
39DD000
direct allocation
page read and write
DB9000
heap
page read and write
578E000
heap
page read and write
CE0000
direct allocation
page execute and read and write
53D0000
trusted library allocation
page read and write
3760000
direct allocation
page read and write
5250000
trusted library allocation
page read and write
2870000
trusted library allocation
page read and write
2B78000
trusted library allocation
page read and write
E74000
heap
page read and write
39D9000
direct allocation
page read and write
B24000
unkown
page execute and read and write
4E6E000
stack
page read and write
616E000
stack
page read and write
2A30000
heap
page execute and read and write
68EE000
stack
page read and write
E73000
heap
page read and write
9CE000
stack
page read and write
2876000
trusted library allocation
page execute and read and write
39DD000
direct allocation
page read and write
9DB000
stack
page read and write
DA6000
heap
page read and write
580E000
stack
page read and write
28A0000
trusted library allocation
page read and write
28B0000
trusted library allocation
page execute and read and write
A50000
heap
page read and write
3833000
direct allocation
page read and write
28E0000
heap
page read and write
CF8000
stack
page read and write
56AC000
stack
page read and write
9BE000
stack
page read and write
5950000
trusted library allocation
page read and write
2F53000
trusted library allocation
page read and write
522A000
trusted library allocation
page read and write
6940000
trusted library allocation
page execute and read and write
There are 225 hidden memdumps, click here to show them.