IOC Report
SecuriteInfo.com.Win64.PWSX-gen.24833.2705.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Win64.PWSX-gen.24833.2705.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SecuriteInfo.com.Win64.PWSX-gen.24833.2705.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.24833.2705.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Win64.PWSX-gen.24833.2705.exe"
 malicious

URLs

Name
IP
Malicious
https://kyliansuperm92139124.shop/customer/809
unknown
https://kyliansuperm92139124.shop
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://go.mic
unknown

Domains

Name
IP
Malicious
kyliansuperm92139124.shop
unknown

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\SecuriteInfo_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
1E22197C000
heap
page read and write
1E2216A5000
heap
page read and write
1E23BB2F000
heap
page read and write
7FF848DF3000
trusted library allocation
page execute and read and write
7FF848EAC000
trusted library allocation
page execute and read and write
7FF848E08000
trusted library allocation
page read and write
D767CFE000
stack
page read and write
7FF848FAB000
trusted library allocation
page read and write
7FF848EA0000
trusted library allocation
page read and write
D7685FE000
stack
page read and write
1E233261000
trusted library allocation
page read and write
D767BFE000
stack
page read and write
7FF848E10000
trusted library allocation
page read and write
D767FFE000
stack
page read and write
D767EFC000
stack
page read and write
7FF849018000
trusted library allocation
page read and write
1E23BB47000
heap
page read and write
1E223240000
heap
page execute and read and write
1E2231A0000
heap
page read and write
1E2217D0000
heap
page read and write
7FF848DFD000
trusted library allocation
page execute and read and write
1E23BB2B000
heap
page read and write
1E2216DD000
heap
page read and write
7FF849020000
trusted library allocation
page read and write
7FF848FE0000
trusted library allocation
page read and write
1E221500000
unkown
page readonly
D767AF3000
stack
page read and write
D7684FE000
stack
page read and write
1E221590000
heap
page read and write
7FF848E02000
trusted library allocation
page read and write
1E233258000
trusted library allocation
page read and write
1E23BB33000
heap
page read and write
1E22171D000
heap
page read and write
1E2232F6000
trusted library allocation
page read and write
1E2216F1000
heap
page read and write
1E2217B0000
heap
page read and write
1E221975000
heap
page read and write
7FF849030000
trusted library allocation
page read and write
1E23BB10000
heap
page read and write
1E233251000
trusted library allocation
page read and write
1E2232EA000
trusted library allocation
page read and write
1E2216B0000
heap
page read and write
1E2216DB000
heap
page read and write
7FF848DF4000
trusted library allocation
page read and write
D7682FD000
stack
page read and write
1E23BE00000
heap
page read and write
7FF47CA10000
trusted library allocation
page execute and read and write
1E223251000
trusted library allocation
page read and write
1E2216E1000
heap
page read and write
7FF849040000
trusted library allocation
page read and write
7FF848FFF000
trusted library allocation
page read and write
1E221830000
trusted library allocation
page read and write
1E2217A3000
heap
page read and write
1E221810000
trusted library allocation
page read and write
1E22171F000
heap
page read and write
7FF848F90000
trusted library allocation
page read and write
7FF848E1D000
trusted library allocation
page execute and read and write
7FF849008000
trusted library allocation
page read and write
1E223203000
heap
page read and write
1E2216E5000
heap
page read and write
1E221970000
heap
page read and write
7FF848E0D000
trusted library allocation
page execute and read and write
1E221723000
heap
page read and write
1E223200000
heap
page read and write
1E2216F4000
heap
page read and write
7FF848E4C000
trusted library allocation
page execute and read and write
1E221502000
unkown
page readonly
1E221840000
heap
page read and write
D767DFF000
stack
page read and write
D7683FE000
stack
page read and write
7FF848EA6000
trusted library allocation
page read and write
1E23BB00000
heap
page execute and read and write
7FF848ED6000
trusted library allocation
page execute and read and write
7FF848E14000
trusted library allocation
page read and write
7FF848F10000
trusted library allocation
page execute and read and write
7FF848E00000
trusted library allocation
page read and write
7FF848DF2000
trusted library allocation
page read and write
1E23BB6C000
heap
page read and write
1E2216A0000
heap
page read and write
1E221670000
heap
page read and write
D7681FE000
stack
page read and write
7FF848FB4000
trusted library allocation
page read and write
7FF849010000
trusted library allocation
page read and write
7FF848EB0000
trusted library allocation
page execute and read and write
1E23DCD0000
trusted library allocation
page read and write
D7680FE000
stack
page read and write
There are 76 hidden memdumps, click here to show them.