IOC Report
gZIZ5eyCtS.exe

loading gif

Files

File Path
Type
Category
Malicious
gZIZ5eyCtS.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gZIZ5eyCtS.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\gZIZ5eyCtS.exe
"C:\Users\user\Desktop\gZIZ5eyCtS.exe"
 malicious
C:\Users\user\Desktop\gZIZ5eyCtS.exe
"C:\Users\user\Desktop\gZIZ5eyCtS.exe"
 malicious

URLs

Name
IP
Malicious
http://aborters.duckdns.org:8081
unknown
http://checkip.dyndns.org/
193.122.6.168
http://schemas.xmlsoap.org/soap/http
unknown
http://anotherarmy.dns.army:8081t-
unknown
http://varders.kozow.com:8081t-
unknown
http://aborters.duckdns.org
unknown
http://anotherarmy.dns.army:8081
unknown
http://anotherarmy.dns.army:8081/_send_.php?TS
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org
unknown
http://aborters.duckdns.org:8081/_send_.php?TS
unknown
http://checkip.dyndns.org
unknown
http://aborters.duckdns.org:8081t-
unknown
http://checkip.dyndns.com
unknown
http://varders.kozow.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://varders.kozow.com:8081
unknown
https://reallyfreegeoip.org/xml/102.129.152.231$
unknown
http://varders.kozow.com:8081/_send_.php?TS
unknown
https://reallyfreegeoip.org/xml/102.129.152.231
172.67.177.134
https://reallyfreegeoip.org/xml/
unknown
There are 12 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
aborters.duckdns.org
51.38.247.67
 malicious
anotherarmy.dns.army
unknown
 malicious
checkip.dyndns.org
unknown
 malicious
reallyfreegeoip.org
172.67.177.134
varders.kozow.com
51.38.247.67
checkip.dyndns.com
193.122.6.168

IPs

IP
Domain
Country
Malicious
51.38.247.67
varders.kozow.com
France
malicious
193.122.6.168
checkip.dyndns.com
United States
172.67.177.134
reallyfreegeoip.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\gZIZ5eyCtS_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\gZIZ5eyCtS_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\gZIZ5eyCtS_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\gZIZ5eyCtS_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\gZIZ5eyCtS_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\gZIZ5eyCtS_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\gZIZ5eyCtS_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\gZIZ5eyCtS_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\gZIZ5eyCtS_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\gZIZ5eyCtS_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\gZIZ5eyCtS_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\gZIZ5eyCtS_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\gZIZ5eyCtS_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\gZIZ5eyCtS_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
29A1000
trusted library allocation
page read and write
 malicious
4663000
trusted library allocation
page read and write
 malicious
2B69000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
1790000
trusted library allocation
page read and write
1C11000
trusted library allocation
page read and write
CA2000
trusted library allocation
page read and write
2A57000
trusted library allocation
page read and write
114C000
stack
page read and write
5C8F000
stack
page read and write
5DD0000
heap
page read and write
66C0000
trusted library allocation
page execute and read and write
632D000
stack
page read and write
100E000
stack
page read and write
2AA6000
trusted library allocation
page read and write
C70000
trusted library allocation
page read and write
2AA2000
trusted library allocation
page read and write
66AA000
trusted library allocation
page read and write
4571000
trusted library allocation
page read and write
2B2D000
trusted library allocation
page read and write
2BF4000
trusted library allocation
page read and write
1664000
trusted library allocation
page read and write
F0A000
heap
page read and write
C8D000
trusted library allocation
page execute and read and write
59B0000
trusted library section
page read and write
C4E000
stack
page read and write
1A60000
trusted library allocation
page read and write
17E7000
heap
page read and write
400000
remote allocation
page execute and read and write
C9A000
trusted library allocation
page execute and read and write
1C70000
heap
page execute and read and write
FBA000
heap
page read and write
1760000
heap
page read and write
2BD6000
trusted library allocation
page read and write
2A46000
trusted library allocation
page read and write
2B49000
trusted library allocation
page read and write
4EA6000
trusted library allocation
page read and write
2A4E000
trusted library allocation
page read and write
2C31000
trusted library allocation
page read and write
1BF0000
trusted library allocation
page read and write
17AE000
heap
page read and write
CE0000
trusted library allocation
page execute and read and write
E00000
heap
page read and write
2C25000
trusted library allocation
page read and write
667D000
trusted library allocation
page read and write
1824000
heap
page read and write
CF0000
heap
page read and write
1CB0000
trusted library allocation
page read and write
3A38000
trusted library allocation
page read and write
1750000
trusted library allocation
page execute and read and write
2AE2000
trusted library allocation
page read and write
1783000
trusted library allocation
page read and write
EFF000
heap
page read and write
3A2C000
trusted library allocation
page read and write
2AEE000
trusted library allocation
page read and write
4EC3000
heap
page read and write
C60000
trusted library allocation
page read and write
2B5B000
trusted library allocation
page read and write
166D000
trusted library allocation
page execute and read and write
1CB4000
trusted library allocation
page read and write
6780000
heap
page read and write
1C16000
trusted library allocation
page read and write
CF5000
heap
page read and write
2BDB000
trusted library allocation
page read and write
16B5000
heap
page read and write
104E000
stack
page read and write
39A1000
trusted library allocation
page read and write
4B3D000
stack
page read and write
2AE6000
trusted library allocation
page read and write
61F2000
heap
page read and write
1650000
trusted library allocation
page read and write
17A0000
heap
page read and write
666E000
stack
page read and write
5A40000
trusted library section
page read and write
1C6E000
stack
page read and write
2980000
trusted library allocation
page read and write
11B0000
heap
page read and write
1BF2000
trusted library allocation
page read and write
17D7000
heap
page read and write
1C90000
heap
page read and write
4EC0000
heap
page read and write
2970000
trusted library allocation
page read and write
17EA000
heap
page read and write
1BF4000
trusted library allocation
page read and write
636E000
stack
page read and write
C74000
trusted library allocation
page read and write
2A63000
trusted library allocation
page read and write
4E8B000
trusted library allocation
page read and write
4F4D000
stack
page read and write
2A54000
trusted library allocation
page read and write
6685000
trusted library allocation
page read and write
2990000
heap
page execute and read and write
1A68000
trusted library allocation
page read and write
C92000
trusted library allocation
page read and write
2A9E000
trusted library allocation
page read and write
1686000
trusted library allocation
page execute and read and write
61F0000
heap
page read and write
1A56000
trusted library allocation
page read and write
1CB9000
trusted library allocation
page read and write
66D0000
trusted library allocation
page read and write
6760000
heap
page read and write
1C8A000
trusted library allocation
page read and write
1660000
trusted library allocation
page read and write
52E0000
trusted library allocation
page execute and read and write
625B000
heap
page read and write
6670000
trusted library allocation
page read and write
AF7000
stack
page read and write
1CBB000
trusted library allocation
page read and write
4E8E000
trusted library allocation
page read and write
4EB2000
trusted library allocation
page read and write
2A43000
trusted library allocation
page read and write
C90000
trusted library allocation
page read and write
C0E000
stack
page read and write
67D0000
trusted library allocation
page execute and read and write
2B4D000
trusted library allocation
page read and write
170E000
stack
page read and write
2A60000
trusted library allocation
page read and write
1BFB000
trusted library allocation
page read and write
CA7000
trusted library allocation
page execute and read and write
2AF2000
trusted library allocation
page read and write
4E9E000
trusted library allocation
page read and write
5A30000
trusted library allocation
page read and write
4EAD000
trusted library allocation
page read and write
FF2000
unkown
page readonly
C96000
trusted library allocation
page execute and read and write
64AE000
stack
page read and write
1C85000
trusted library allocation
page read and write
63AE000
stack
page read and write
1786000
trusted library allocation
page read and write
2B11000
trusted library allocation
page read and write
5A00000
trusted library allocation
page read and write
E20000
trusted library allocation
page read and write
FF0000
unkown
page readonly
17D4000
heap
page read and write
17E3000
heap
page read and write
1A50000
trusted library allocation
page read and write
3A22000
trusted library allocation
page read and write
4EE0000
trusted library allocation
page read and write
F11000
heap
page read and write
75A000
stack
page read and write
66B0000
trusted library allocation
page execute and read and write
2ADE000
trusted library allocation
page read and write
61F7000
heap
page read and write
2AF6000
trusted library allocation
page read and write
C7D000
trusted library allocation
page execute and read and write
1B7F000
stack
page read and write
E7E000
stack
page read and write
1898000
heap
page read and write
ECD000
stack
page read and write
1C0E000
trusted library allocation
page read and write
1663000
trusted library allocation
page execute and read and write
185A000
heap
page read and write
1C8D000
trusted library allocation
page read and write
5B80000
heap
page execute and read and write
E30000
heap
page read and write
164E000
stack
page read and write
199E000
stack
page read and write
422000
remote allocation
page execute and read and write
52D0000
trusted library allocation
page read and write
1CA0000
trusted library allocation
page read and write
6688000
trusted library allocation
page read and write
CAB000
trusted library allocation
page execute and read and write
1C80000
trusted library allocation
page read and write
4E80000
trusted library allocation
page read and write
C73000
trusted library allocation
page execute and read and write
174E000
stack
page read and write
2C1E000
trusted library allocation
page read and write
2A7B000
trusted library allocation
page read and write
1C25000
trusted library allocation
page read and write
6690000
trusted library allocation
page execute and read and write
DFF000
stack
page read and write
185E000
heap
page read and write
16B0000
heap
page read and write
1680000
trusted library allocation
page read and write
6740000
trusted library allocation
page read and write
2A4B000
trusted library allocation
page read and write
356E000
stack
page read and write
2ADA000
trusted library allocation
page read and write
1780000
trusted library allocation
page read and write
ED0000
heap
page read and write
5A35000
trusted library allocation
page read and write
168A000
trusted library allocation
page execute and read and write
16C0000
trusted library allocation
page read and write
566E000
stack
page read and write
60EE000
stack
page read and write
11C0000
heap
page read and write
CD0000
heap
page read and write
160E000
stack
page read and write
7D0000
heap
page read and write
39C9000
trusted library allocation
page read and write
2BF9000
trusted library allocation
page read and write
4EA1000
trusted library allocation
page read and write
66E0000
trusted library allocation
page read and write
53FF000
stack
page read and write
2BE1000
trusted library allocation
page read and write
4E86000
trusted library allocation
page read and write
2A9A000
trusted library allocation
page read and write
6680000
trusted library allocation
page read and write
2BEA000
trusted library allocation
page read and write
2AEA000
trusted library allocation
page read and write
6267000
heap
page read and write
5A10000
trusted library allocation
page read and write
3571000
trusted library allocation
page read and write
1690000
trusted library allocation
page read and write
2974000
trusted library allocation
page read and write
1674000
trusted library allocation
page read and write
52F0000
heap
page execute and read and write
5010000
heap
page read and write
1697000
trusted library allocation
page execute and read and write
296E000
stack
page read and write
66A0000
trusted library allocation
page read and write
668B000
trusted library allocation
page read and write
2B1F000
trusted library allocation
page read and write
656E000
stack
page read and write
1CBE000
trusted library allocation
page read and write
2C62000
trusted library allocation
page read and write
1A70000
heap
page read and write
ED8000
heap
page read and write
2C2B000
trusted library allocation
page read and write
EF8000
heap
page read and write
2BFD000
trusted library allocation
page read and write
17CB000
heap
page read and write
3A07000
trusted library allocation
page read and write
2A90000
trusted library allocation
page read and write
E80000
heap
page read and write
7C0000
heap
page read and write
169B000
trusted library allocation
page execute and read and write
5B2F000
stack
page read and write
61EE000
stack
page read and write
C80000
trusted library allocation
page read and write
14F7000
stack
page read and write
CA5000
trusted library allocation
page execute and read and write
4E9A000
trusted library allocation
page read and write
1CC0000
heap
page read and write
6251000
heap
page read and write
2A92000
trusted library allocation
page read and write
There are 226 hidden memdumps, click here to show them.