IOC Report
SecuriteInfo.com.Win32.CrypterX-gen.9933.28197.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Win32.CrypterX-gen.9933.28197.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_ab57bd3284d196bd7ec453d15d15a137caef7f6_11f66400_82455a3c-da68-4fcf-a9d1-0c34bf279a06\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER748C.tmp.dmp
Mini DuMP crash report, 15 streams, Thu Mar 28 09:25:30 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER76AF.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER772D.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\VFZJMER1OXAF8SLHTCHET0W3HVJJKMG5
Zip archive data, at least v2.0 to extract, compression method=store
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.9933.28197.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.CrypterX-gen.9933.28197.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7016 -s 984

URLs

Name
IP
Malicious
https://trecube.com/getjson.php?id=40
172.67.177.174
 malicious
https://trecube.com/
172.67.177.174
 malicious
https://trecube.com/gate.php?id=40&build=kokaine&passwords=0&cookies=2&username=user&country=US&ip=102.165.48.43&BSSID=f97a416a99bc6b1f20bdfbfefa6a73cf&wallets=0&token=xehook40788749&ext=0&filters=0&pcname=305090&cardsc=0&telegram=False&discord=False&steam=False&domaindetect=
172.67.177.174
 malicious
https://trecube.com/getloader.php?id=40
172.67.177.174
 malicious
https://unotree.ru/
unknown
http://ip-api.com/json/?fields=11827
208.95.112.1
http://ip-api.com
unknown
https://t.me/xehook
unknown
http://upx.sf.net
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://trecube.com
unknown
http://trecube.com
unknown
https://www.cloudflare.com/5xx-error-landing
unknown
http://ip-api.com/line/?fields=hosting
unknown
https://trecube.com/gate.php?id=40&build=kokaine&passwords=0&cookies=2&username=user&country=US&ip
unknown
There are 5 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
trecube.com
172.67.177.174
 malicious
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
172.67.177.174
trecube.com
United States
malicious
208.95.112.1
ip-api.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileDirectory
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
ProgramId
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
FileId
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
LowerCaseLongPath
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
LongPathHash
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
Name
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
OriginalFileName
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
Publisher
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
Version
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
BinFileVersion
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
BinaryType
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
ProductName
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
ProductVersion
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
LinkDate
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
BinProductVersion
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
AppxPackageFullName
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
AppxPackageRelativeId
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
Size
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
Language
\REGISTRY\A\{40a76fbc-8b14-eb5f-a555-3b49f07326d7}\Root\InventoryApplicationFile\securiteinfo.com|22dfda6f9f78231a
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018C00B8F8B0D2B
There are 28 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
872000
unkown
page readonly
 malicious
2AA0000
heap
page read and write
6700000
trusted library allocation
page read and write
E45000
heap
page read and write
F70000
heap
page read and write
2EA4000
trusted library allocation
page read and write
2F47000
trusted library allocation
page read and write
6580000
trusted library allocation
page read and write
2C91000
trusted library allocation
page read and write
51E3000
trusted library allocation
page read and write
51C4000
trusted library allocation
page read and write
CFA000
stack
page read and write
F60000
trusted library allocation
page read and write
2F87000
trusted library allocation
page read and write
2C58000
trusted library allocation
page read and write
30B8000
trusted library allocation
page read and write
E3D000
heap
page read and write
11CE000
stack
page read and write
3EC4000
trusted library allocation
page read and write
3E57000
trusted library allocation
page read and write
2E51000
trusted library allocation
page read and write
649E000
stack
page read and write
6435000
trusted library allocation
page read and write
109B000
trusted library allocation
page execute and read and write
100F000
heap
page read and write
6950000
heap
page read and write
2C6E000
stack
page read and write
5FE3000
heap
page read and write
121B000
trusted library allocation
page execute and read and write
5FFA000
heap
page read and write
532E000
stack
page read and write
2F6E000
trusted library allocation
page read and write
2D2C000
stack
page read and write
51B2000
trusted library allocation
page read and write
694A000
heap
page read and write
1230000
trusted library allocation
page read and write
FA1000
heap
page read and write
5E4E000
stack
page read and write
6013000
heap
page read and write
5190000
trusted library allocation
page read and write
620D000
stack
page read and write
51D6000
trusted library allocation
page read and write
F64000
trusted library allocation
page read and write
9F0000
heap
page read and write
EC0000
heap
page read and write
2FA9000
trusted library allocation
page read and write
658A000
trusted library allocation
page read and write
2A70000
trusted library allocation
page read and write
E90000
heap
page read and write
556E000
stack
page read and write
2E9E000
trusted library allocation
page read and write
5E8E000
stack
page read and write
115F000
stack
page read and write
542F000
stack
page read and write
624E000
stack
page read and write
1202000
trusted library allocation
page read and write
9ED000
stack
page read and write
11F0000
trusted library allocation
page read and write
E53000
heap
page read and write
11EE000
stack
page read and write
9A0000
heap
page read and write
1017000
heap
page read and write
60CE000
stack
page read and write
2EC2000
trusted library allocation
page read and write
692D000
stack
page read and write
51BE000
trusted library allocation
page read and write
F53000
trusted library allocation
page execute and read and write
11E4000
trusted library allocation
page read and write
10E0000
heap
page read and write
11E0000
trusted library allocation
page read and write
61CE000
stack
page read and write
51E5000
trusted library allocation
page read and write
1217000
trusted library allocation
page execute and read and write
E1E000
heap
page read and write
3C95000
trusted library allocation
page read and write
F9F000
heap
page read and write
E88000
heap
page read and write
F54000
trusted library allocation
page read and write
1200000
trusted library allocation
page read and write
F69000
heap
page read and write
2E30000
trusted library allocation
page read and write
5200000
trusted library allocation
page read and write
D78000
stack
page read and write
2A90000
trusted library allocation
page execute and read and write
F3E000
stack
page read and write
2EC6000
trusted library allocation
page read and write
2C9A000
trusted library allocation
page read and write
402000
remote allocation
page execute and read and write
10C0000
trusted library allocation
page execute and read and write
6590000
trusted library allocation
page execute and read and write
400000
remote allocation
page execute and read and write
2C80000
heap
page execute and read and write
F4E000
stack
page read and write
6940000
heap
page read and write
51F0000
trusted library allocation
page read and write
5D4E000
stack
page read and write
2E86000
trusted library allocation
page read and write
638E000
stack
page read and write
EF5000
heap
page read and write
6AF0000
heap
page read and write
6450000
trusted library allocation
page execute and read and write
2F0E000
trusted library allocation
page read and write
628E000
stack
page read and write
10B0000
trusted library allocation
page read and write
E97000
heap
page read and write
EF0000
heap
page read and write
1206000
trusted library allocation
page execute and read and write
640E000
stack
page read and write
66CE000
stack
page read and write
11ED000
trusted library allocation
page execute and read and write
29CE000
stack
page read and write
2E96000
trusted library allocation
page read and write
65C0000
trusted library allocation
page read and write
2F6C000
trusted library allocation
page read and write
5F90000
heap
page read and write
6430000
trusted library allocation
page read and write
51E0000
heap
page execute and read and write
63CE000
stack
page read and write
E80000
heap
page read and write
54CE000
stack
page read and write
526E000
stack
page read and write
E10000
heap
page read and write
990000
heap
page read and write
DE0000
heap
page read and write
7FC40000
trusted library allocation
page execute and read and write
2FAF000
trusted library allocation
page read and write
1212000
trusted library allocation
page read and write
F60000
heap
page read and write
F5D000
trusted library allocation
page execute and read and write
2E2D000
stack
page read and write
2B2E000
stack
page read and write
1090000
trusted library allocation
page read and write
2C98000
trusted library allocation
page execute and read and write
FE9000
heap
page read and write
C7C000
stack
page read and write
574E000
stack
page read and write
2BAF000
stack
page read and write
2E84000
trusted library allocation
page read and write
2AEF000
stack
page read and write
E00000
trusted library allocation
page read and write
1210000
trusted library allocation
page read and write
2C30000
trusted library allocation
page execute and read and write
3E79000
trusted library allocation
page read and write
6750000
trusted library allocation
page read and write
4D8E000
stack
page read and write
560E000
stack
page read and write
1180000
heap
page read and write
2E92000
trusted library allocation
page read and write
F40000
heap
page read and write
2C2E000
stack
page read and write
1215000
trusted library allocation
page execute and read and write
674B000
stack
page read and write
2C40000
heap
page read and write
1097000
trusted library allocation
page execute and read and write
E3B000
heap
page read and write
52EE000
stack
page read and write
6760000
trusted library allocation
page read and write
2E8E000
trusted library allocation
page read and write
6770000
heap
page read and write
107F000
stack
page read and write
2EEA000
trusted library allocation
page read and write
550D000
stack
page read and write
546E000
stack
page read and write
F94000
heap
page read and write
5F8E000
stack
page read and write
3C91000
trusted library allocation
page read and write
120A000
trusted library allocation
page execute and read and write
6960000
heap
page read and write
92C000
stack
page read and write
10D0000
trusted library allocation
page read and write
2E40000
heap
page execute and read and write
1240000
heap
page read and write
30E6000
trusted library allocation
page read and write
11D0000
trusted library allocation
page read and write
3E99000
trusted library allocation
page read and write
E1A000
heap
page read and write
564E000
stack
page read and write
870000
unkown
page readonly
1045000
heap
page read and write
3EA1000
trusted library allocation
page read and write
11E3000
trusted library allocation
page execute and read and write
3E51000
trusted library allocation
page read and write
1187000
heap
page read and write
EA1000
heap
page read and write
5280000
heap
page execute and read and write
2E7D000
trusted library allocation
page read and write
2BED000
stack
page read and write
There are 177 hidden memdumps, click here to show them.