IOC Report
proforma_Invoice_0009300_74885959969_9876.exe

loading gif

Files

File Path
Type
Category
Malicious
proforma_Invoice_0009300_74885959969_9876.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\proforma_Invoice_0009300_74885959969_9876.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\proforma_Invoice_0009300_74885959969_9876.exe
C:\Users\user\Desktop\proforma_Invoice_0009300_74885959969_9876.exe
 malicious
C:\Users\user\Desktop\proforma_Invoice_0009300_74885959969_9876.exe
C:\Users\user\Desktop\proforma_Invoice_0009300_74885959969_9876.exe
 malicious
C:\Windows\SysWOW64\cmd.exe
C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\proforma_Invoice_0009300_74885959969_9876.exe
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\choice.exe
choice /C Y /N /D Y /T 3

URLs

Name
IP
Malicious
https://scratchdreams.tk
unknown
 malicious
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.org/
193.122.6.168
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/191.96.227.194
104.21.67.152
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://reallyfreegeoip.org/xml/191.96.227.194$
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
checkip.dyndns.org
unknown
 malicious
reallyfreegeoip.org
104.21.67.152
checkip.dyndns.com
193.122.6.168

IPs

IP
Domain
Country
Malicious
104.21.67.152
reallyfreegeoip.org
United States
193.122.6.168
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\proforma_Invoice_0009300_74885959969_9876_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\proforma_Invoice_0009300_74885959969_9876_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\proforma_Invoice_0009300_74885959969_9876_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\proforma_Invoice_0009300_74885959969_9876_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\proforma_Invoice_0009300_74885959969_9876_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\proforma_Invoice_0009300_74885959969_9876_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\proforma_Invoice_0009300_74885959969_9876_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\proforma_Invoice_0009300_74885959969_9876_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\proforma_Invoice_0009300_74885959969_9876_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\proforma_Invoice_0009300_74885959969_9876_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\proforma_Invoice_0009300_74885959969_9876_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\proforma_Invoice_0009300_74885959969_9876_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\proforma_Invoice_0009300_74885959969_9876_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\proforma_Invoice_0009300_74885959969_9876_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
3604000
trusted library allocation
page read and write
 malicious
2BF1000
trusted library allocation
page read and write
 malicious
3511000
trusted library allocation
page read and write
8D8000
heap
page read and write
73A000
trusted library allocation
page execute and read and write
560E000
stack
page read and write
8BA000
heap
page read and write
109E000
stack
page read and write
61CE000
stack
page read and write
3310000
heap
page read and write
5070000
heap
page execute and read and write
6A80000
heap
page read and write
2B75000
trusted library allocation
page read and write
568E000
stack
page read and write
2D48000
trusted library allocation
page read and write
C7E000
stack
page read and write
C10000
heap
page read and write
2D34000
trusted library allocation
page read and write
2B84000
trusted library allocation
page read and write
644E000
stack
page read and write
B30000
heap
page read and write
2D30000
trusted library allocation
page read and write
4A06000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
4A45000
trusted library allocation
page read and write
4B7E000
trusted library allocation
page read and write
4BC0000
trusted library section
page read and write
1100000
trusted library allocation
page read and write
946000
heap
page read and write
10F0000
heap
page read and write
2CB6000
trusted library allocation
page read and write
10D4000
trusted library allocation
page read and write
2CE8000
trusted library allocation
page read and write
2B66000
trusted library allocation
page read and write
F90000
heap
page read and write
7C0000
heap
page read and write
4BB0000
trusted library allocation
page read and write
2B80000
trusted library allocation
page read and write
5690000
trusted library allocation
page read and write
5F8E000
stack
page read and write
2CF4000
trusted library allocation
page read and write
B20000
heap
page read and write
99F000
heap
page read and write
66E000
stack
page read and write
1112000
trusted library allocation
page read and write
34F3000
heap
page read and write
2CF8000
trusted library allocation
page read and write
6BCE000
stack
page read and write
64CE000
stack
page read and write
335E000
unkown
page read and write
2D38000
trusted library allocation
page read and write
660E000
stack
page read and write
CA0000
heap
page read and write
1257000
heap
page read and write
1110000
trusted library allocation
page read and write
6D0000
heap
page read and write
4B90000
trusted library allocation
page read and write
2CB9000
trusted library allocation
page read and write
54CE000
stack
page read and write
3BF7000
trusted library allocation
page read and write
2BB0000
trusted library allocation
page read and write
1117000
trusted library allocation
page execute and read and write
50E0000
heap
page read and write
3C19000
trusted library allocation
page read and write
34DC000
heap
page read and write
6AE000
stack
page read and write
620000
heap
page read and write
238D000
stack
page read and write
EA8000
heap
page read and write
2D40000
trusted library allocation
page read and write
49FE000
trusted library allocation
page read and write
4A30000
trusted library allocation
page read and write
1102000
trusted library allocation
page read and write
49EB000
trusted library allocation
page read and write
3BF1000
trusted library allocation
page read and write
4B79000
trusted library allocation
page read and write
678F000
stack
page read and write
4CEC000
stack
page read and write
5190000
heap
page read and write
608E000
stack
page read and write
7E0000
trusted library allocation
page read and write
90B000
heap
page read and write
630F000
stack
page read and write
4BB5000
trusted library allocation
page read and write
382F000
heap
page read and write
988000
heap
page read and write
49E2000
trusted library allocation
page read and write
14A000
unkown
page readonly
4A26000
trusted library allocation
page read and write
564E000
stack
page read and write
1250000
heap
page read and write
49E0000
trusted library allocation
page read and write
4A50000
heap
page execute and read and write
720000
trusted library allocation
page read and write
1106000
trusted library allocation
page execute and read and write
4990000
trusted library section
page read and write
2B44000
trusted library allocation
page read and write
2B4E000
trusted library allocation
page read and write
34F2000
heap
page read and write
5D4E000
stack
page read and write
1DC000
stack
page read and write
2D83000
trusted library allocation
page read and write
51A0000
heap
page read and write
4A4A000
trusted library allocation
page read and write
4A4D000
trusted library allocation
page read and write
4DE0000
heap
page read and write
33A0000
heap
page read and write
6A6C000
stack
page read and write
714000
trusted library allocation
page read and write
2DB1000
trusted library allocation
page read and write
111B000
trusted library allocation
page execute and read and write
4DED000
heap
page read and write
460D000
stack
page read and write
620E000
stack
page read and write
2AFE000
stack
page read and write
4B80000
trusted library allocation
page read and write
D2E000
stack
page read and write
6369000
heap
page read and write
4A20000
trusted library allocation
page read and write
2B86000
trusted library allocation
page read and write
EBE000
heap
page read and write
8BE000
heap
page read and write
B48000
heap
page read and write
747000
trusted library allocation
page execute and read and write
B40000
heap
page read and write
2CAD000
trusted library allocation
page read and write
2DBF000
trusted library allocation
page read and write
36CF000
unkown
page read and write
2D75000
trusted library allocation
page read and write
117E000
stack
page read and write
710000
trusted library allocation
page read and write
6ACE000
stack
page read and write
2D4C000
trusted library allocation
page read and write
10D3000
trusted library allocation
page execute and read and write
10D0000
trusted library allocation
page read and write
2B90000
trusted library allocation
page read and write
2D3C000
trusted library allocation
page read and write
4A38000
trusted library allocation
page read and write
4A01000
trusted library allocation
page read and write
E9E000
stack
page read and write
506D000
stack
page read and write
ABC000
stack
page read and write
4B60000
trusted library allocation
page read and write
32FD000
stack
page read and write
BAE000
stack
page read and write
1240000
heap
page execute and read and write
3490000
heap
page read and write
1220000
trusted library allocation
page execute and read and write
2511000
trusted library allocation
page read and write
3010000
heap
page read and write
55CE000
stack
page read and write
664E000
stack
page read and write
2BE0000
heap
page read and write
4A40000
trusted library allocation
page read and write
668E000
stack
page read and write
34D0000
heap
page read and write
D2000
unkown
page readonly
67B0000
heap
page read and write
498E000
stack
page read and write
1130000
trusted library allocation
page read and write
D7E000
stack
page read and write
2CF0000
trusted library allocation
page read and write
2400000
heap
page execute and read and write
8E5000
heap
page read and write
10DD000
trusted library allocation
page execute and read and write
2D9F000
trusted library allocation
page read and write
50BE000
stack
page read and write
382F000
heap
page read and write
49E4000
trusted library allocation
page read and write
EC9000
heap
page read and write
4B5E000
stack
page read and write
37CF000
stack
page read and write
2B69000
trusted library allocation
page read and write
9A7000
stack
page read and write
6F0000
heap
page read and write
A7C000
stack
page read and write
D2E000
stack
page read and write
1230000
trusted library allocation
page read and write
7D0000
trusted library allocation
page read and write
8DD000
heap
page read and write
2CD1000
trusted library allocation
page read and write
92C000
heap
page read and write
F62000
heap
page read and write
71D000
trusted library allocation
page execute and read and write
10C0000
trusted library allocation
page read and write
7F0000
heap
page read and write
2CFC000
trusted library allocation
page read and write
AAF000
stack
page read and write
65CF000
stack
page read and write
250E000
stack
page read and write
736000
trusted library allocation
page execute and read and write
EDA000
heap
page read and write
10E0000
trusted library allocation
page read and write
2D67000
trusted library allocation
page read and write
D30000
heap
page read and write
2D44000
trusted library allocation
page read and write
2DC6000
trusted library allocation
page read and write
7AE000
stack
page read and write
6310000
heap
page read and write
2B54000
trusted library allocation
page read and write
8FA000
heap
page read and write
2E6F000
stack
page read and write
33B0000
heap
page read and write
696B000
stack
page read and write
D0000
unkown
page readonly
74B000
trusted library allocation
page execute and read and write
540000
heap
page read and write
700000
trusted library allocation
page read and write
941000
heap
page read and write
5E4F000
stack
page read and write
8F2000
heap
page read and write
EA0000
heap
page read and write
2CE6000
trusted library allocation
page read and write
60CE000
stack
page read and write
4B70000
trusted library allocation
page read and write
8B0000
heap
page read and write
2DA3000
trusted library allocation
page read and write
5F4F000
stack
page read and write
339E000
stack
page read and write
631F000
heap
page read and write
D90000
heap
page read and write
713000
trusted library allocation
page execute and read and write
4F7000
stack
page read and write
723000
trusted library allocation
page read and write
EF2000
heap
page read and write
2B3C000
stack
page read and write
2FAD000
stack
page read and write
4B74000
trusted library allocation
page read and write
7B0000
trusted library allocation
page execute and read and write
CEF000
stack
page read and write
8AB000
stack
page read and write
648E000
stack
page read and write
110A000
trusted library allocation
page execute and read and write
4A15000
trusted library allocation
page read and write
D96000
heap
page read and write
There are 226 hidden memdumps, click here to show them.