IOC Report
NEW QUOTATION.exe

loading gif

Files

File Path
Type
Category
Malicious
NEW QUOTATION.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NEW QUOTATION.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\NEW QUOTATION.exe
"C:\Users\user\Desktop\NEW QUOTATION.exe"
 malicious
C:\Users\user\Desktop\NEW QUOTATION.exe
"C:\Users\user\Desktop\NEW QUOTATION.exe"
 malicious

URLs

Name
IP
Malicious
https://account.dyn.com/
unknown
https://api.telegram.org
unknown
http://api.telegram.org
unknown
https://api.telegram.org/bot6359985836:AAEpvgyD3CBEihuwlXNMLbKTgPfew2N22lc/sendDocument
149.154.167.220
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://api.telegram.org/bot6359985836:AAEpvgyD3CBEihuwlXNMLbKTgPfew2N22lc/
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
ip-api.com
208.95.112.1
api.telegram.org
149.154.167.220

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
149.154.167.220
api.telegram.org
United Kingdom

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NEW QUOTATION_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NEW QUOTATION_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NEW QUOTATION_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NEW QUOTATION_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NEW QUOTATION_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NEW QUOTATION_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NEW QUOTATION_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NEW QUOTATION_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NEW QUOTATION_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NEW QUOTATION_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NEW QUOTATION_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NEW QUOTATION_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NEW QUOTATION_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\NEW QUOTATION_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
32E9000
trusted library allocation
page read and write
 malicious
32B0000
trusted library allocation
page read and write
 malicious
32DD000
trusted library allocation
page read and write
 malicious
42EE000
trusted library allocation
page read and write
 malicious
7360000
trusted library section
page read and write
6FD0000
heap
page read and write
2E90000
trusted library allocation
page read and write
7CCE000
stack
page read and write
1190000
heap
page read and write
159A000
heap
page read and write
2F96000
trusted library allocation
page read and write
17C7000
trusted library allocation
page execute and read and write
75C0000
trusted library allocation
page execute and read and write
11B0000
heap
page read and write
7D0E000
stack
page read and write
1775000
trusted library allocation
page execute and read and write
1544000
trusted library allocation
page read and write
7500000
trusted library section
page read and write
6EE0000
trusted library allocation
page read and write
14B5000
heap
page read and write
2EF0000
heap
page read and write
315E000
trusted library allocation
page read and write
1292000
heap
page read and write
7C8E000
stack
page read and write
3306000
trusted library allocation
page read and write
571A000
trusted library allocation
page read and write
6FBE000
stack
page read and write
5955000
heap
page read and write
1543000
trusted library allocation
page execute and read and write
74A0000
heap
page read and write
5700000
trusted library allocation
page read and write
17CB000
trusted library allocation
page execute and read and write
723E000
stack
page read and write
2E00000
trusted library allocation
page read and write
17E0000
heap
page read and write
1285000
heap
page read and write
4119000
trusted library allocation
page read and write
A4AE000
stack
page read and write
6D93000
trusted library allocation
page read and write
3270000
heap
page read and write
35DE000
trusted library allocation
page read and write
1560000
trusted library allocation
page read and write
2F9D000
trusted library allocation
page read and write
6C80000
heap
page read and write
3194000
trusted library allocation
page read and write
17D0000
heap
page execute and read and write
5790000
trusted library section
page readonly
42A9000
trusted library allocation
page read and write
125A000
heap
page read and write
15A7000
heap
page read and write
1550000
trusted library allocation
page read and write
55B0000
trusted library allocation
page read and write
760E000
stack
page read and write
2FE0000
trusted library allocation
page read and write
A6EF000
stack
page read and write
146E000
stack
page read and write
127C000
heap
page read and write
4281000
trusted library allocation
page read and write
75EE000
stack
page read and write
318F000
trusted library allocation
page read and write
C62000
unkown
page readonly
A5AF000
stack
page read and write
C60000
unkown
page readonly
155D000
trusted library allocation
page execute and read and write
1578000
heap
page read and write
572D000
trusted library allocation
page read and write
35FB000
trusted library allocation
page read and write
5721000
trusted library allocation
page read and write
2EF3000
heap
page read and write
5970000
heap
page read and write
717E000
stack
page read and write
1562000
trusted library allocation
page read and write
33EE000
trusted library allocation
page read and write
17B6000
trusted library allocation
page execute and read and write
5744000
trusted library allocation
page read and write
2FB0000
trusted library allocation
page read and write
31CE000
stack
page read and write
6D83000
trusted library allocation
page read and write
31D8000
trusted library allocation
page read and write
310F000
stack
page read and write
32DB000
trusted library allocation
page read and write
7430000
trusted library allocation
page read and write
1344000
heap
page read and write
5750000
trusted library allocation
page read and write
7510000
trusted library section
page read and write
7410000
heap
page read and write
DAA000
stack
page read and write
5590000
heap
page read and write
58ED000
stack
page read and write
57A0000
heap
page execute and read and write
4203000
trusted library allocation
page read and write
125E000
heap
page read and write
5E00000
trusted library allocation
page read and write
67BD000
stack
page read and write
42E9000
trusted library allocation
page read and write
7F340000
trusted library allocation
page execute and read and write
2E4E000
stack
page read and write
70B0000
heap
page read and write
5940000
trusted library section
page read and write
6EC0000
trusted library allocation
page read and write
2F60000
trusted library allocation
page read and write
53BD000
stack
page read and write
151E000
stack
page read and write
17D7000
heap
page read and write
570B000
trusted library allocation
page read and write
1777000
trusted library allocation
page execute and read and write
6DA0000
trusted library allocation
page read and write
123D000
trusted library allocation
page execute and read and write
5712000
trusted library allocation
page read and write
6CF6000
heap
page read and write
5DE0000
heap
page read and write
55D0000
trusted library allocation
page read and write
1540000
trusted library allocation
page read and write
2EB9000
trusted library allocation
page read and write
5990000
heap
page read and write
1234000
trusted library allocation
page read and write
1278000
heap
page read and write
735E000
stack
page read and write
57BC000
stack
page read and write
17E7000
heap
page read and write
17C0000
trusted library allocation
page read and write
1250000
heap
page read and write
4167000
trusted library allocation
page read and write
7400000
heap
page read and write
161E000
stack
page read and write
6DFE000
stack
page read and write
52BC000
stack
page read and write
5760000
heap
page execute and read and write
35CC000
trusted library allocation
page read and write
1350000
heap
page read and write
725E000
stack
page read and write
1233000
trusted library allocation
page execute and read and write
5732000
trusted library allocation
page read and write
55A0000
heap
page read and write
6F7E000
stack
page read and write
5860000
heap
page read and write
74EE000
stack
page read and write
12F7000
heap
page read and write
17C0000
trusted library allocation
page read and write
41B5000
trusted library allocation
page read and write
1120000
heap
page read and write
5E07000
trusted library allocation
page read and write
7EEB0000
trusted library allocation
page execute and read and write
8D47000
trusted library allocation
page read and write
6CE1000
heap
page read and write
5706000
trusted library allocation
page read and write
15A4000
heap
page read and write
7520000
trusted library allocation
page execute and read and write
1790000
trusted library allocation
page read and write
7680000
trusted library allocation
page read and write
5726000
trusted library allocation
page read and write
1772000
trusted library allocation
page read and write
A3AE000
stack
page read and write
1243000
trusted library allocation
page read and write
6C8C000
heap
page read and write
2F7B000
trusted library allocation
page read and write
5550000
trusted library allocation
page read and write
5AE0000
trusted library allocation
page read and write
57EC000
stack
page read and write
15DF000
heap
page read and write
6D80000
trusted library allocation
page read and write
43C000
remote allocation
page execute and read and write
733E000
stack
page read and write
154D000
trusted library allocation
page execute and read and write
3111000
trusted library allocation
page read and write
7530000
trusted library allocation
page read and write
570E000
trusted library allocation
page read and write
7450000
heap
page read and write
16AE000
stack
page read and write
10F7000
stack
page read and write
1296000
heap
page read and write
124D000
trusted library allocation
page execute and read and write
14FE000
stack
page read and write
1470000
heap
page read and write
2F00000
heap
page execute and read and write
3313000
trusted library allocation
page read and write
2EB0000
trusted library allocation
page read and write
5B9C000
stack
page read and write
1520000
trusted library allocation
page read and write
58F0000
heap
page read and write
7470000
trusted library allocation
page execute and read and write
5740000
trusted library allocation
page read and write
11B5000
heap
page read and write
2F50000
trusted library allocation
page execute and read and write
32F5000
trusted library allocation
page read and write
6CC2000
heap
page read and write
3000000
heap
page read and write
6ED0000
trusted library allocation
page execute and read and write
1603000
heap
page read and write
1290000
heap
page read and write
11FE000
stack
page read and write
18EF000
stack
page read and write
5853000
heap
page read and write
6D9D000
trusted library allocation
page read and write
1537000
heap
page read and write
17A0000
trusted library allocation
page execute and read and write
400000
remote allocation
page execute and read and write
2F8E000
trusted library allocation
page read and write
3281000
trusted library allocation
page read and write
43E000
remote allocation
page execute and read and write
17C2000
trusted library allocation
page read and write
A5EE000
stack
page read and write
7540000
trusted library section
page read and write
1220000
trusted library allocation
page read and write
30CE000
stack
page read and write
2F70000
trusted library allocation
page read and write
1770000
trusted library allocation
page read and write
17D0000
heap
page read and write
2E8E000
stack
page read and write
520C000
stack
page read and write
70BE000
heap
page read and write
55C0000
trusted library allocation
page execute and read and write
1530000
heap
page read and write
77B2000
trusted library allocation
page read and write
177B000
trusted library allocation
page execute and read and write
118E000
stack
page read and write
5910000
trusted library allocation
page execute and read and write
14B0000
heap
page read and write
3302000
trusted library allocation
page read and write
5850000
heap
page read and write
32E5000
trusted library allocation
page read and write
571E000
trusted library allocation
page read and write
2FA2000
trusted library allocation
page read and write
5931000
trusted library allocation
page read and write
17B0000
trusted library allocation
page read and write
1140000
heap
page read and write
2FC0000
trusted library allocation
page read and write
3379000
trusted library allocation
page read and write
FE9000
stack
page read and write
3151000
trusted library allocation
page read and write
4111000
trusted library allocation
page read and write
158F000
heap
page read and write
17BA000
trusted library allocation
page execute and read and write
2F74000
trusted library allocation
page read and write
32E1000
trusted library allocation
page read and write
5960000
heap
page read and write
156A000
trusted library allocation
page execute and read and write
1240000
trusted library allocation
page read and write
68BF000
stack
page read and write
2F91000
trusted library allocation
page read and write
6DB0000
trusted library allocation
page execute and read and write
2FD0000
trusted library allocation
page read and write
165D000
heap
page read and write
2F4C000
stack
page read and write
5900000
heap
page read and write
1500000
heap
page read and write
1230000
trusted library allocation
page read and write
2FD5000
trusted library allocation
page read and write
5DF0000
trusted library allocation
page read and write
1110000
heap
page read and write
1566000
trusted library allocation
page execute and read and write
5950000
heap
page read and write
1570000
heap
page read and write
17B0000
trusted library allocation
page read and write
12F9000
stack
page read and write
There are 245 hidden memdumps, click here to show them.