IOC Report
Quote GVSE24-00815.exe

loading gif

Files

File Path
Type
Category
Malicious
Quote GVSE24-00815.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Quote GVSE24-00815.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2tivak4j.3p4.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_itkhhyeh.24p.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pjnwwi5w.tds.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tjgib2nb.30d.ps1
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Quote GVSE24-00815.exe
"C:\Users\user\Desktop\Quote GVSE24-00815.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Quote GVSE24-00815.exe"
 malicious
C:\Users\user\Desktop\Quote GVSE24-00815.exe
"C:\Users\user\Desktop\Quote GVSE24-00815.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://mail.zqamcx.com
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
https://account.dyn.com/
unknown
http://r11.o.lencr.org0#
unknown
http://www.fontbureau.com/designers?
unknown
http://tempuri.org/ianiDataSet2.xsdM
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0
unknown
http://www.carterandcone.coml
unknown
http://tempuri.org/ianiDataSet.xsd
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://tempuri.org/ianiDataSet1.xsd
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://ip-api.com
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://zqamcx.com
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
http://r11.i.lencr.org/0#
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
There are 29 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
mail.zqamcx.com
unknown
 malicious
zqamcx.com
78.110.166.82
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
78.110.166.82
zqamcx.com
United Kingdom

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Quote GVSE24-00815_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Quote GVSE24-00815_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Quote GVSE24-00815_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Quote GVSE24-00815_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Quote GVSE24-00815_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Quote GVSE24-00815_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Quote GVSE24-00815_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Quote GVSE24-00815_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Quote GVSE24-00815_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Quote GVSE24-00815_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Quote GVSE24-00815_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Quote GVSE24-00815_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Quote GVSE24-00815_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Quote GVSE24-00815_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
2EE5000
trusted library allocation
page read and write
 malicious
2E95000
trusted library allocation
page read and write
 malicious
2EC2000
trusted library allocation
page read and write
 malicious
3749000
trusted library allocation
page read and write
 malicious
6FEE000
stack
page read and write
9FDE000
stack
page read and write
2E44000
trusted library allocation
page read and write
54C0000
heap
page execute and read and write
138E000
stack
page read and write
E30000
trusted library allocation
page execute and read and write
A81000
heap
page read and write
9D1E000
stack
page read and write
2D10000
heap
page read and write
A2B000
trusted library allocation
page execute and read and write
2FCD000
trusted library allocation
page read and write
68B0000
trusted library allocation
page read and write
70EE000
stack
page read and write
7010000
heap
page read and write
E40000
heap
page read and write
6E40000
trusted library allocation
page read and write
27A5000
trusted library allocation
page read and write
1267000
heap
page read and write
6EB0000
heap
page read and write
5190000
heap
page read and write
7210000
trusted library section
page read and write
9C1E000
stack
page read and write
4C00000
trusted library allocation
page read and write
127D000
trusted library allocation
page execute and read and write
4C20000
trusted library allocation
page read and write
A10000
trusted library allocation
page read and write
69DD000
trusted library allocation
page read and write
1084000
heap
page read and write
9E0000
trusted library allocation
page read and write
F98000
heap
page read and write
2C46000
trusted library allocation
page execute and read and write
513D000
stack
page read and write
477C000
stack
page read and write
6B60000
trusted library allocation
page read and write
63CD000
stack
page read and write
26EE000
stack
page read and write
487B000
stack
page read and write
4F90000
heap
page read and write
4C40000
trusted library allocation
page read and write
31C3000
trusted library allocation
page read and write
4F80000
trusted library allocation
page execute and read and write
2ED4000
trusted library allocation
page read and write
A4C0000
trusted library allocation
page read and write
53B0000
heap
page read and write
332000
unkown
page readonly
6EE8000
heap
page read and write
F70000
heap
page read and write
535E000
trusted library allocation
page read and write
6ECD000
stack
page read and write
6EAE000
stack
page read and write
64CF000
stack
page read and write
1250000
trusted library allocation
page read and write
A35F000
stack
page read and write
534B000
trusted library allocation
page read and write
D98000
trusted library allocation
page read and write
6DEE000
stack
page read and write
900000
heap
page read and write
2C52000
trusted library allocation
page read and write
A6B000
heap
page read and write
6FF0000
trusted library allocation
page read and write
2EFC000
trusted library allocation
page read and write
A7F000
heap
page read and write
4E00000
heap
page read and write
4E68000
trusted library allocation
page read and write
4BE6000
trusted library allocation
page read and write
2710000
trusted library allocation
page read and write
6A77000
trusted library allocation
page read and write
6B4E000
stack
page read and write
4CC3000
heap
page read and write
2E20000
trusted library allocation
page read and write
4DE5000
heap
page read and write
970000
heap
page read and write
6E8E000
stack
page read and write
E39000
stack
page read and write
7F0E0000
trusted library allocation
page execute and read and write
6990000
trusted library allocation
page read and write
574C000
stack
page read and write
A22000
trusted library allocation
page read and write
F90000
heap
page read and write
D3E000
stack
page read and write
6F17000
heap
page read and write
6F13000
heap
page read and write
1280000
heap
page read and write
536D000
trusted library allocation
page read and write
534E000
trusted library allocation
page read and write
6A1D000
stack
page read and write
4BED000
trusted library allocation
page read and write
69B0000
trusted library allocation
page read and write
4BC4000
trusted library allocation
page read and write
2D00000
trusted library allocation
page execute and read and write
585E000
unkown
page read and write
4BDE000
trusted library allocation
page read and write
F39000
stack
page read and write
2EE1000
trusted library allocation
page read and write
A5F000
heap
page read and write
2C70000
trusted library allocation
page read and write
A16000
trusted library allocation
page execute and read and write
4BCB000
trusted library allocation
page read and write
4CB0000
trusted library allocation
page read and write
5352000
trusted library allocation
page read and write
68A8000
heap
page read and write
9FD000
trusted library allocation
page execute and read and write
69C0000
trusted library allocation
page execute and read and write
A03000
trusted library allocation
page read and write
1270000
trusted library allocation
page read and write
4CC0000
heap
page read and write
C3F000
stack
page read and write
6EC4000
heap
page read and write
4C15000
trusted library allocation
page read and write
A39C000
stack
page read and write
2C3D000
trusted library allocation
page execute and read and write
2EC8000
trusted library allocation
page read and write
6E50000
trusted library allocation
page execute and read and write
5366000
trusted library allocation
page read and write
A40000
heap
page read and write
5361000
trusted library allocation
page read and write
A00000
trusted library allocation
page read and write
5380000
heap
page read and write
13CE000
stack
page read and write
ADE000
heap
page read and write
1274000
trusted library allocation
page read and write
2C4A000
trusted library allocation
page execute and read and write
5140000
heap
page read and write
5240000
trusted library allocation
page read and write
A27000
trusted library allocation
page execute and read and write
688D000
stack
page read and write
6FCE000
stack
page read and write
1273000
trusted library allocation
page execute and read and write
D40000
trusted library allocation
page read and write
2EF8000
trusted library allocation
page read and write
6E2E000
stack
page read and write
4C92000
trusted library allocation
page read and write
9BE000
stack
page read and write
5A70000
heap
page read and write
68D2000
trusted library allocation
page read and write
69D0000
trusted library allocation
page read and write
5340000
trusted library allocation
page read and write
A49C000
stack
page read and write
D8E000
stack
page read and write
2EC0000
trusted library allocation
page read and write
2730000
heap
page read and write
4C80000
heap
page read and write
A1A000
trusted library allocation
page execute and read and write
2C30000
trusted library allocation
page read and write
4E10000
heap
page read and write
B0B000
heap
page read and write
3E89000
trusted library allocation
page read and write
9E9E000
stack
page read and write
6A20000
trusted library allocation
page execute and read and write
2E61000
trusted library allocation
page read and write
FC7000
heap
page read and write
279A000
trusted library allocation
page read and write
A21E000
stack
page read and write
3741000
trusted library allocation
page read and write
2C42000
trusted library allocation
page read and write
4F60000
trusted library section
page read and write
2E1E000
stack
page read and write
820000
heap
page read and write
6CB0000
heap
page read and write
5150000
heap
page read and write
3EC9000
trusted library allocation
page read and write
6D0D000
stack
page read and write
6998000
trusted library allocation
page read and write
2741000
trusted library allocation
page read and write
5384000
heap
page read and write
A0D000
trusted library allocation
page execute and read and write
69B7000
trusted library allocation
page read and write
678E000
stack
page read and write
4D80000
trusted library allocation
page read and write
4DDB000
stack
page read and write
2E30000
trusted library allocation
page read and write
2CFC000
stack
page read and write
4F30000
trusted library allocation
page execute and read and write
6D4F000
stack
page read and write
1287000
heap
page read and write
7260000
heap
page read and write
2720000
heap
page execute and read and write
FC5000
heap
page read and write
AB4000
heap
page read and write
A4B0000
trusted library allocation
page read and write
517E000
heap
page read and write
A11E000
stack
page read and write
2E40000
trusted library allocation
page read and write
A4E000
heap
page read and write
27A3000
trusted library allocation
page read and write
4CA0000
trusted library allocation
page execute and read and write
4BE1000
trusted library allocation
page read and write
2E50000
heap
page execute and read and write
6A70000
trusted library allocation
page read and write
FBA000
heap
page read and write
330000
unkown
page readonly
9F4000
trusted library allocation
page read and write
26F0000
trusted library allocation
page read and write
95E000
stack
page read and write
5159000
heap
page read and write
6B6B000
trusted library allocation
page read and write
5372000
trusted library allocation
page read and write
68FD000
heap
page read and write
A0DE000
stack
page read and write
400000
remote allocation
page execute and read and write
F75000
heap
page read and write
68D2000
heap
page read and write
2C50000
trusted library allocation
page read and write
2C5B000
trusted library allocation
page execute and read and write
4DF0000
trusted library section
page readonly
4F70000
trusted library allocation
page read and write
A25E000
stack
page read and write
AD0000
heap
page read and write
6890000
heap
page read and write
5390000
trusted library allocation
page read and write
6D8E000
stack
page read and write
4E30000
heap
page execute and read and write
6ECC000
heap
page read and write
2C55000
trusted library allocation
page execute and read and write
6B0E000
stack
page read and write
9F9E000
stack
page read and write
11CE000
stack
page read and write
910000
heap
page read and write
4BC0000
trusted library allocation
page read and write
A74000
heap
page read and write
2C57000
trusted library allocation
page execute and read and write
760E000
stack
page read and write
4DE0000
heap
page read and write
7000000
trusted library allocation
page execute and read and write
11D0000
heap
page read and write
4C90000
trusted library allocation
page read and write
5B7000
stack
page read and write
564C000
stack
page read and write
E47000
heap
page read and write
69A0000
heap
page read and write
9F0000
trusted library allocation
page read and write
2C40000
trusted library allocation
page read and write
6ECE000
heap
page read and write
2700000
trusted library allocation
page read and write
10B0000
heap
page read and write
690D000
heap
page read and write
9F3000
trusted library allocation
page execute and read and write
4BA000
stack
page read and write
AE6000
heap
page read and write
2EED000
trusted library allocation
page read and write
1260000
heap
page read and write
6B50000
trusted library allocation
page read and write
2CBE000
stack
page read and write
3E61000
trusted library allocation
page read and write
4BF2000
trusted library allocation
page read and write
4C10000
trusted library allocation
page read and write
4FFE000
stack
page read and write
6A6E000
stack
page read and write
There are 243 hidden memdumps, click here to show them.