IOC Report
MT103.exe

loading gif

Files

File Path
Type
Category
Malicious
MT103.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MT103.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\MT103.exe
"C:\Users\user\Desktop\MT103.exe"
 malicious
C:\Users\user\Desktop\MT103.exe
"C:\Users\user\Desktop\MT103.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
172.67.74.152
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
https://account.dyn.com/
unknown
http://smtp.italiacanda-it.com
unknown
http://us2.smtp.mailhostbox.com
unknown
http://www.fontbureau.com/designers?
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
https://api.ipify.org/t
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
https://api.ipify.org
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.ascendercorp.com/typedesigners.html
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
There are 23 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
smtp.italiacanda-it.com
unknown
 malicious
us2.smtp.mailhostbox.com
208.91.198.143
api.ipify.org
172.67.74.152

IPs

IP
Domain
Country
Malicious
208.91.198.143
us2.smtp.mailhostbox.com
United States
172.67.74.152
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MT103_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MT103_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MT103_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MT103_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MT103_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MT103_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MT103_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MT103_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MT103_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MT103_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MT103_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MT103_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MT103_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\MT103_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3EDF000
trusted library allocation
page read and write
 malicious
2FE1000
trusted library allocation
page read and write
 malicious
300B000
trusted library allocation
page read and write
 malicious
8E2000
unkown
page readonly
 malicious
402000
remote allocation
page execute and read and write
 malicious
5195000
trusted library allocation
page read and write
6CCD000
stack
page read and write
51C0000
trusted library allocation
page read and write
B1FE000
stack
page read and write
5634000
trusted library allocation
page read and write
F6B000
heap
page read and write
8D4E000
stack
page read and write
B5BE000
stack
page read and write
31A0000
trusted library allocation
page read and write
1356000
heap
page read and write
5190000
trusted library allocation
page read and write
4F98000
trusted library allocation
page read and write
15FA000
trusted library allocation
page execute and read and write
55B1000
trusted library allocation
page read and write
5590000
trusted library section
page read and write
EC0000
trusted library allocation
page read and write
787D000
stack
page read and write
2BE0000
heap
page execute and read and write
5DC7000
heap
page read and write
D37000
stack
page read and write
DA0000
heap
page read and write
560E000
trusted library allocation
page read and write
2D96000
trusted library allocation
page read and write
C3A000
stack
page read and write
5960000
heap
page execute and read and write
5520000
trusted library allocation
page execute and read and write
55FE000
trusted library allocation
page read and write
55A0000
heap
page read and write
7380000
trusted library section
page read and write
7350000
heap
page read and write
5DA1000
heap
page read and write
3D93000
trusted library allocation
page read and write
12B7000
trusted library allocation
page execute and read and write
2E17000
trusted library allocation
page read and write
8B26000
heap
page read and write
76BE000
stack
page read and write
52BB000
stack
page read and write
2E6E000
stack
page read and write
6DD7000
trusted library allocation
page read and write
7470000
trusted library allocation
page read and write
54F0000
heap
page read and write
6DD0000
trusted library allocation
page read and write
990000
unkown
page readonly
12F0000
trusted library allocation
page read and write
595E000
stack
page read and write
514E000
trusted library allocation
page read and write
5BAE000
stack
page read and write
2C30000
trusted library allocation
page read and write
5270000
trusted library allocation
page read and write
ED0000
trusted library allocation
page read and write
B6BD000
stack
page read and write
1620000
trusted library allocation
page read and write
2D48000
trusted library allocation
page read and write
5510000
trusted library allocation
page read and write
160B000
trusted library allocation
page execute and read and write
8AE0000
heap
page read and write
67C7000
heap
page read and write
2E48000
trusted library allocation
page read and write
5616000
trusted library allocation
page read and write
15F2000
trusted library allocation
page read and write
5630000
trusted library allocation
page read and write
131D000
trusted library allocation
page execute and read and write
1395000
heap
page read and write
F8C000
heap
page read and write
5640000
trusted library allocation
page read and write
5170000
trusted library allocation
page read and write
130D000
trusted library allocation
page execute and read and write
B3BE000
stack
page read and write
5CEE000
stack
page read and write
5611000
trusted library allocation
page read and write
FCA000
heap
page read and write
6C7D000
trusted library allocation
page read and write
EA0000
trusted library allocation
page read and write
69FE000
stack
page read and write
5213000
heap
page read and write
2E5D000
trusted library allocation
page read and write
15F6000
trusted library allocation
page execute and read and write
12B0000
trusted library allocation
page read and write
6AFE000
stack
page read and write
5450000
heap
page execute and read and write
1303000
trusted library allocation
page execute and read and write
51A0000
trusted library allocation
page read and write
561D000
trusted library allocation
page read and write
506C000
stack
page read and write
5220000
trusted library allocation
page execute and read and write
2F8E000
stack
page read and write
F20000
heap
page read and write
EE0000
heap
page read and write
15F0000
trusted library allocation
page read and write
ED6000
trusted library allocation
page execute and read and write
5238000
trusted library allocation
page read and write
5790000
heap
page read and write
EB0000
trusted library allocation
page read and write
6E80000
trusted library allocation
page read and write
667D000
stack
page read and write
F9C000
heap
page read and write
7150000
trusted library allocation
page read and write
3CF7000
trusted library allocation
page read and write
1640000
heap
page read and write
1687000
heap
page read and write
5180000
trusted library allocation
page read and write
68BD000
stack
page read and write
6B4E000
stack
page read and write
3CA1000
trusted library allocation
page read and write
1310000
trusted library allocation
page read and write
4DDC000
stack
page read and write
728E000
heap
page read and write
55F6000
trusted library allocation
page read and write
1320000
heap
page read and write
5120000
trusted library allocation
page read and write
2BCE000
stack
page read and write
2CF5000
trusted library allocation
page read and write
1630000
trusted library allocation
page execute and read and write
56DE000
stack
page read and write
3007000
trusted library allocation
page read and write
134A000
heap
page read and write
3FB9000
trusted library allocation
page read and write
7180000
heap
page read and write
3009000
trusted library allocation
page read and write
1300000
trusted library allocation
page read and write
131E000
stack
page read and write
73B0000
trusted library allocation
page read and write
55D0000
trusted library allocation
page execute and read and write
E20000
heap
page read and write
2C90000
heap
page read and write
5540000
heap
page read and write
2FCF000
trusted library allocation
page read and write
E70000
heap
page read and write
5D90000
heap
page read and write
5793000
heap
page read and write
653D000
stack
page read and write
F83000
heap
page read and write
DF0000
heap
page read and write
2CA1000
trusted library allocation
page read and write
5160000
trusted library allocation
page read and write
E6E000
stack
page read and write
F08000
heap
page read and write
B9BE000
stack
page read and write
1605000
trusted library allocation
page execute and read and write
516E000
stack
page read and write
EBD000
trusted library allocation
page execute and read and write
5460000
trusted library section
page readonly
5134000
trusted library allocation
page read and write
2E80000
heap
page execute and read and write
DED000
stack
page read and write
5CAE000
stack
page read and write
749C000
trusted library allocation
page read and write
1670000
trusted library allocation
page read and write
8B49000
heap
page read and write
591C000
stack
page read and write
D90000
heap
page read and write
2E70000
trusted library allocation
page read and write
2D94000
trusted library allocation
page read and write
6789000
heap
page read and write
6EA2000
trusted library allocation
page read and write
B8BE000
stack
page read and write
8AF0000
heap
page read and write
1600000
trusted library allocation
page read and write
7F2B0000
trusted library allocation
page execute and read and write
1650000
heap
page read and write
1354000
heap
page read and write
63FE000
stack
page read and write
8E0000
unkown
page readonly
5210000
heap
page read and write
6DE0000
trusted library allocation
page read and write
EDA000
stack
page read and write
515D000
trusted library allocation
page read and write
6C4F000
stack
page read and write
2BD0000
trusted library allocation
page execute and read and write
6D8E000
stack
page read and write
6C70000
trusted library allocation
page read and write
B6C0000
heap
page read and write
5545000
heap
page read and write
EDA000
trusted library allocation
page execute and read and write
1602000
trusted library allocation
page read and write
2C40000
trusted library allocation
page read and write
FD9000
stack
page read and write
5660000
heap
page read and write
EB4000
trusted library allocation
page read and write
783E000
stack
page read and write
1607000
trusted library allocation
page execute and read and write
5602000
trusted library allocation
page read and write
6C68000
trusted library allocation
page read and write
1328000
heap
page read and write
1225000
heap
page read and write
7390000
trusted library section
page read and write
3FFA000
trusted library allocation
page read and write
5200000
heap
page read and write
400000
remote allocation
page execute and read and write
5B6F000
stack
page read and write
55FB000
trusted library allocation
page read and write
5156000
trusted library allocation
page read and write
11AE000
stack
page read and write
6C80000
trusted library allocation
page read and write
5A6C000
stack
page read and write
12BB000
trusted library allocation
page execute and read and write
6C87000
trusted library allocation
page read and write
5130000
trusted library allocation
page read and write
B1BD000
stack
page read and write
6B00000
heap
page read and write
EE8000
heap
page read and write
1680000
heap
page read and write
2FC6000
trusted library allocation
page read and write
73F0000
trusted library section
page read and write
2F91000
trusted library allocation
page read and write
7F680000
trusted library allocation
page execute and read and write
ED2000
trusted library allocation
page read and write
12B0000
heap
page read and write
B4BE000
stack
page read and write
513B000
trusted library allocation
page read and write
E25000
heap
page read and write
F22000
heap
page read and write
EB3000
trusted library allocation
page execute and read and write
5162000
trusted library allocation
page read and write
1320000
heap
page read and write
3E9E000
trusted library allocation
page read and write
3F91000
trusted library allocation
page read and write
ECD000
trusted library allocation
page execute and read and write
69BE000
stack
page read and write
5151000
trusted library allocation
page read and write
73A0000
trusted library allocation
page execute and read and write
2C2E000
stack
page read and write
6CE0000
trusted library allocation
page execute and read and write
13EA000
heap
page read and write
558E000
stack
page read and write
8D70000
trusted library allocation
page execute and read and write
FA0000
heap
page read and write
F90000
heap
page read and write
677E000
stack
page read and write
1220000
heap
page read and write
6CD0000
trusted library allocation
page read and write
4CDC000
stack
page read and write
12B2000
trusted library allocation
page read and write
301B000
trusted library allocation
page read and write
5500000
heap
page read and write
12AE000
stack
page read and write
55F0000
trusted library allocation
page read and write
8B44000
heap
page read and write
2D44000
trusted library allocation
page read and write
7280000
heap
page read and write
7190000
trusted library allocation
page execute and read and write
12D0000
trusted library allocation
page read and write
3D45000
trusted library allocation
page read and write
6C60000
trusted library allocation
page read and write
3022000
trusted library allocation
page read and write
5622000
trusted library allocation
page read and write
1260000
heap
page read and write
55C0000
trusted library allocation
page read and write
663E000
stack
page read and write
2E29000
trusted library allocation
page read and write
5230000
trusted library allocation
page read and write
1250000
heap
page read and write
76FE000
stack
page read and write
5240000
trusted library allocation
page read and write
EEE000
heap
page read and write
5DA9000
heap
page read and write
2C60000
trusted library allocation
page execute and read and write
1327000
heap
page read and write
2FDD000
trusted library allocation
page read and write
1304000
trusted library allocation
page read and write
6CF0000
trusted library allocation
page execute and read and write
77FE000
stack
page read and write
6780000
heap
page read and write
3CA9000
trusted library allocation
page read and write
5D80000
heap
page read and write
560A000
trusted library allocation
page read and write
There are 261 hidden memdumps, click here to show them.