IOC Report
NEWORDER.exe

loading gif

Files

File Path
Type
Category
Malicious
NEWORDER.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\overfertilize
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\NEWORDER.exe
"C:\Users\user\Desktop\NEWORDER.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\NEWORDER.exe"
 malicious

URLs

Name
IP
Malicious
http://checkip.dyndns.org/
132.226.247.73
https://reallyfreegeoip.org/xml/8.46.123.189
104.21.96.1
https://reallyfreegeoip.org/xml/8.46.123.189l
unknown
http://checkip.dyndns.comd
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.orgd
unknown
https://reallyfreegeoip.org/xml/8.46.123.189d
unknown
http://reallyfreegeoip.org
unknown
http://checkip.dyndns.orgd
unknown
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.com
unknown
http://checkip.dyndns.org/d
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://api.telegram.org/bot-/sendDocument?chat_id=
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 6 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
104.21.96.1
checkip.dyndns.com
132.226.247.73
checkip.dyndns.org
unknown

IPs

IP
Domain
Country
Malicious
104.21.96.1
reallyfreegeoip.org
United States
132.226.247.73
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1110000
direct allocation
page read and write
 malicious
402000
system
page execute and read and write
 malicious
13E0000
heap
page read and write
727000
unkown
page readonly
3D69000
direct allocation
page read and write
3BC3000
direct allocation
page read and write
6F0000
unkown
page write copy
3BA3000
direct allocation
page read and write
960000
heap
page read and write
12FE000
heap
page read and write
643F000
stack
page read and write
1230000
heap
page read and write
6580000
trusted library allocation
page read and write
5556000
trusted library allocation
page read and write
6460000
heap
page read and write
1140000
heap
page read and write
3BA3000
direct allocation
page read and write
1D5E000
stack
page read and write
131F000
heap
page read and write
3DBE000
direct allocation
page read and write
3D6D000
direct allocation
page read and write
5312000
trusted library allocation
page read and write
6720000
heap
page read and write
EF7000
stack
page read and write
620000
unkown
page readonly
3C40000
direct allocation
page read and write
52E6000
trusted library allocation
page read and write
3C20000
direct allocation
page read and write
13E0000
heap
page read and write
FEF000
stack
page read and write
2F17000
trusted library allocation
page read and write
623E000
stack
page read and write
4F6E000
stack
page read and write
621000
unkown
page execute read
1460000
trusted library allocation
page read and write
5554000
trusted library allocation
page read and write
1432000
trusted library allocation
page read and write
9CE000
stack
page read and write
1400000
trusted library allocation
page read and write
1311000
heap
page read and write
5870000
trusted library allocation
page execute and read and write
633E000
stack
page read and write
131A000
heap
page read and write
5320000
trusted library allocation
page read and write
2E9E000
trusted library allocation
page read and write
6700000
heap
page read and write
5306000
trusted library allocation
page read and write
2F55000
trusted library allocation
page read and write
131F000
heap
page read and write
144B000
trusted library allocation
page execute and read and write
2E9B000
trusted library allocation
page read and write
3EA1000
trusted library allocation
page read and write
131F000
heap
page read and write
534B000
trusted library allocation
page read and write
54AD000
stack
page read and write
3D49000
direct allocation
page read and write
6BC000
unkown
page readonly
603E000
stack
page read and write
2EB0000
trusted library allocation
page read and write
5340000
trusted library allocation
page read and write
647A000
heap
page read and write
1160000
heap
page read and write
2ECD000
trusted library allocation
page read and write
3C40000
direct allocation
page read and write
95E000
stack
page read and write
12E4000
heap
page read and write
131A000
heap
page read and write
130B000
heap
page read and write
6540000
trusted library allocation
page read and write
3D69000
direct allocation
page read and write
2C6E000
stack
page read and write
57EE000
stack
page read and write
131F000
heap
page read and write
53AE000
stack
page read and write
3E54000
trusted library allocation
page read and write
1311000
heap
page read and write
1323000
heap
page read and write
1442000
trusted library allocation
page read and write
3644000
heap
page read and write
3D6D000
direct allocation
page read and write
1440000
trusted library allocation
page read and write
6BC000
unkown
page readonly
1451000
heap
page read and write
6F4000
unkown
page readonly
12E4000
heap
page read and write
6E2000
unkown
page readonly
139A000
heap
page read and write
52D3000
heap
page read and write
119F000
heap
page read and write
195E000
stack
page read and write
6EC000
unkown
page read and write
3DDE000
direct allocation
page read and write
128F000
heap
page read and write
1316000
heap
page read and write
FFF000
stack
page read and write
6547000
trusted library allocation
page read and write
2F0C000
trusted library allocation
page read and write
119B000
heap
page read and write
1323000
heap
page read and write
142D000
trusted library allocation
page execute and read and write
3654000
heap
page read and write
1323000
heap
page read and write
141D000
trusted library allocation
page execute and read and write
5560000
heap
page execute and read and write
1445000
trusted library allocation
page execute and read and write
910000
heap
page read and write
1470000
heap
page execute and read and write
1311000
heap
page read and write
FCF000
stack
page read and write
1430000
trusted library allocation
page read and write
552E000
stack
page read and write
10F0000
heap
page read and write
1211000
heap
page read and write
3D49000
direct allocation
page read and write
586E000
stack
page read and write
11D1000
heap
page read and write
2F33000
trusted library allocation
page read and write
12E4000
heap
page read and write
400000
system
page execute and read and write
FB5000
heap
page read and write
6E2000
unkown
page readonly
3E69000
trusted library allocation
page read and write
139A000
heap
page read and write
3A80000
direct allocation
page read and write
3C20000
direct allocation
page read and write
52EB000
trusted library allocation
page read and write
3D4D000
direct allocation
page read and write
3D4D000
direct allocation
page read and write
3D6D000
direct allocation
page read and write
2E31000
trusted library allocation
page read and write
2F4B000
trusted library allocation
page read and write
980000
heap
page read and write
5540000
trusted library allocation
page read and write
52B0000
trusted library allocation
page read and write
130B000
heap
page read and write
12FE000
heap
page read and write
143A000
trusted library allocation
page execute and read and write
3AA0000
direct allocation
page read and write
2F49000
trusted library allocation
page read and write
6560000
trusted library allocation
page read and write
1436000
trusted library allocation
page execute and read and write
2F20000
trusted library allocation
page read and write
12F2000
heap
page read and write
52C0000
trusted library allocation
page read and write
3640000
heap
page read and write
65E0000
heap
page read and write
F90000
heap
page read and write
3BA3000
direct allocation
page read and write
1316000
heap
page read and write
130B000
heap
page read and write
6F4000
unkown
page readonly
530D000
trusted library allocation
page read and write
130D000
heap
page read and write
3582000
heap
page read and write
12F2000
heap
page read and write
144B000
heap
page execute and read and write
3C20000
direct allocation
page read and write
134F000
heap
page read and write
555A000
trusted library allocation
page read and write
F20000
heap
page read and write
130D000
heap
page read and write
2E93000
trusted library allocation
page read and write
1323000
heap
page read and write
1316000
heap
page read and write
57AF000
stack
page read and write
1420000
trusted library allocation
page read and write
3A80000
direct allocation
page read and write
2F2E000
trusted library allocation
page read and write
6EC000
unkown
page write copy
131A000
heap
page read and write
2F10000
trusted library allocation
page read and write
12F2000
heap
page read and write
12FE000
heap
page read and write
3BC3000
direct allocation
page read and write
3D69000
direct allocation
page read and write
130B000
heap
page read and write
3AA0000
direct allocation
page read and write
5301000
trusted library allocation
page read and write
52FE000
trusted library allocation
page read and write
1414000
trusted library allocation
page read and write
1168000
heap
page read and write
5F3E000
stack
page read and write
2EEE000
trusted library allocation
page read and write
3C40000
direct allocation
page read and write
FBF000
stack
page read and write
52D0000
heap
page read and write
F70000
heap
page read and write
5880000
trusted library allocation
page execute and read and write
3DDE000
direct allocation
page read and write
5530000
trusted library allocation
page execute and read and write
3DBE000
direct allocation
page read and write
2F43000
trusted library allocation
page read and write
11AF000
heap
page read and write
613E000
stack
page read and write
BBA000
stack
page read and write
3DBE000
direct allocation
page read and write
11A0000
heap
page read and write
FDB000
stack
page read and write
12F2000
heap
page read and write
582E000
stack
page read and write
11D8000
heap
page read and write
1192000
heap
page read and write
6570000
trusted library allocation
page execute and read and write
2ED9000
trusted library allocation
page read and write
1251000
heap
page read and write
53C0000
trusted library allocation
page read and write
130D000
heap
page read and write
4E6D000
stack
page read and write
64B1000
heap
page read and write
3DDE000
direct allocation
page read and write
621000
unkown
page execute read
52EE000
trusted library allocation
page read and write
3A80000
direct allocation
page read and write
3E5D000
trusted library allocation
page read and write
1311000
heap
page read and write
1410000
trusted library allocation
page read and write
2E96000
trusted library allocation
page read and write
130D000
heap
page read and write
2D20000
heap
page read and write
2EEA000
trusted library allocation
page read and write
8A9000
stack
page read and write
3D49000
direct allocation
page read and write
12E4000
heap
page read and write
1194000
heap
page read and write
3B11000
heap
page read and write
119F000
heap
page read and write
1413000
trusted library allocation
page execute and read and write
2E2E000
stack
page read and write
2EAE000
trusted library allocation
page read and write
41A000
system
page execute and read and write
131A000
heap
page read and write
727000
unkown
page readonly
FB0000
heap
page read and write
1316000
heap
page read and write
52E0000
trusted library allocation
page read and write
6440000
heap
page read and write
3E31000
trusted library allocation
page read and write
3AA0000
direct allocation
page read and write
54ED000
stack
page read and write
6550000
trusted library allocation
page read and write
1447000
trusted library allocation
page execute and read and write
2F86000
trusted library allocation
page read and write
11A8000
heap
page read and write
2F2A000
trusted library allocation
page read and write
2EE6000
trusted library allocation
page read and write
1480000
heap
page read and write
3A82000
heap
page read and write
3BC3000
direct allocation
page read and write
12FE000
heap
page read and write
2D10000
trusted library allocation
page execute and read and write
52FA000
trusted library allocation
page read and write
2F4F000
trusted library allocation
page read and write
620000
unkown
page readonly
3D4D000
direct allocation
page read and write
There are 244 hidden memdumps, click here to show them.