IOC Report
Gcerti Quote.exe

loading gif

Files

File Path
Type
Category
Malicious
Gcerti Quote.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Gcerti Quote.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Gcerti Quote.exe
"C:\Users\user\Desktop\Gcerti Quote.exe"
 malicious
C:\Users\user\Desktop\Gcerti Quote.exe
"C:\Users\user\Desktop\Gcerti Quote.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.12.205
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
http://smtp.italiacanda-it.com
unknown
https://api.ipify.org/t
unknown
http://us2.smtp.mailhostbox.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Domains

Name
IP
Malicious
smtp.italiacanda-it.com
unknown
 malicious
us2.smtp.mailhostbox.com
208.91.198.143
api.ipify.org
104.26.12.205

IPs

IP
Domain
Country
Malicious
208.91.198.143
us2.smtp.mailhostbox.com
United States
104.26.12.205
api.ipify.org
United States
208.91.199.225
unknown
United States
208.91.199.223
unknown
United States
208.91.199.224
unknown
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Gcerti Quote_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Gcerti Quote_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Gcerti Quote_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Gcerti Quote_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Gcerti Quote_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Gcerti Quote_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Gcerti Quote_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Gcerti Quote_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Gcerti Quote_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Gcerti Quote_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Gcerti Quote_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Gcerti Quote_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Gcerti Quote_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Gcerti Quote_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
32A1000
trusted library allocation
page read and write
 malicious
379C000
trusted library allocation
page read and write
 malicious
32CB000
trusted library allocation
page read and write
 malicious
4F6E000
heap
page read and write
459B000
stack
page read and write
68D0000
heap
page read and write
831E000
stack
page read and write
CCA000
trusted library allocation
page execute and read and write
2340000
trusted library allocation
page read and write
18B0000
heap
page read and write
253E000
stack
page read and write
68D9000
heap
page read and write
68E000
stack
page read and write
1600000
heap
page read and write
91D000
trusted library allocation
page execute and read and write
4A2A000
trusted library allocation
page read and write
4B70000
heap
page execute and read and write
1810000
trusted library allocation
page read and write
181D000
trusted library allocation
page execute and read and write
538E000
stack
page read and write
811E000
stack
page read and write
1830000
trusted library allocation
page read and write
184B000
trusted library allocation
page execute and read and write
640000
heap
page read and write
715000
heap
page read and write
49E4000
trusted library allocation
page read and write
6E6E000
stack
page read and write
24AF000
stack
page read and write
1840000
trusted library allocation
page read and write
56D6000
trusted library allocation
page read and write
6D60000
trusted library allocation
page read and write
16F7000
heap
page read and write
15A0000
trusted library allocation
page execute and read and write
CD2000
trusted library allocation
page read and write
7F5D000
stack
page read and write
4F87000
heap
page read and write
42B7000
trusted library allocation
page read and write
192000
unkown
page readonly
15B0000
trusted library allocation
page read and write
32C7000
trusted library allocation
page read and write
3561000
trusted library allocation
page read and write
6DAD000
stack
page read and write
139A000
heap
page read and write
6BE0000
heap
page read and write
264A000
trusted library allocation
page read and write
4D20000
trusted library section
page read and write
339E000
trusted library allocation
page read and write
24F3000
trusted library allocation
page read and write
861E000
stack
page read and write
18D0000
trusted library allocation
page read and write
571E000
stack
page read and write
1836000
trusted library allocation
page execute and read and write
2360000
heap
page read and write
576A000
trusted library allocation
page read and write
4A01000
trusted library allocation
page read and write
903000
trusted library allocation
page execute and read and write
58B0000
heap
page read and write
4AA0000
heap
page read and write
56E2000
trusted library allocation
page read and write
5710000
trusted library allocation
page read and write
578C000
stack
page read and write
1847000
trusted library allocation
page execute and read and write
5790000
heap
page execute and read and write
56D0000
trusted library allocation
page read and write
8F0000
trusted library allocation
page read and write
2350000
trusted library allocation
page read and write
6D40000
trusted library allocation
page read and write
5743000
heap
page read and write
673E000
stack
page read and write
4DFC000
stack
page read and write
6D48000
trusted library allocation
page read and write
56EE000
trusted library allocation
page read and write
15C0000
trusted library allocation
page read and write
90D000
trusted library allocation
page execute and read and write
6ABE000
stack
page read and write
6DD0000
trusted library allocation
page execute and read and write
5720000
trusted library allocation
page read and write
7F080000
trusted library allocation
page execute and read and write
722000
heap
page read and write
575E000
stack
page read and write
32D4000
trusted library allocation
page read and write
CC0000
trusted library allocation
page read and write
5760000
trusted library allocation
page read and write
1813000
trusted library allocation
page execute and read and write
6BE000
heap
page read and write
319E000
stack
page read and write
64AE000
stack
page read and write
3240000
heap
page execute and read and write
50C0000
trusted library section
page read and write
875E000
stack
page read and write
5080000
trusted library allocation
page read and write
5740000
heap
page read and write
66FE000
stack
page read and write
375E000
trusted library allocation
page read and write
4279000
trusted library allocation
page read and write
50A0000
trusted library allocation
page execute and read and write
4251000
trusted library allocation
page read and write
1650000
heap
page read and write
5070000
heap
page read and write
49EB000
trusted library allocation
page read and write
35B7000
trusted library allocation
page read and write
1320000
heap
page read and write
6BA000
heap
page read and write
4F80000
heap
page read and write
6BBE000
stack
page read and write
3C7000
stack
page read and write
1370000
heap
page read and write
1610000
trusted library allocation
page execute and read and write
1456000
heap
page read and write
6B0000
heap
page read and write
6F0000
heap
page read and write
6840000
heap
page read and write
2330000
trusted library allocation
page read and write
5120000
trusted library allocation
page execute and read and write
630000
heap
page read and write
3653000
trusted library allocation
page read and write
59B0000
trusted library section
page read and write
6890000
heap
page read and write
7A2000
heap
page read and write
6DB0000
heap
page read and write
56FD000
trusted library allocation
page read and write
4B5E000
stack
page read and write
328F000
trusted library allocation
page read and write
56DB000
trusted library allocation
page read and write
25B1000
trusted library allocation
page read and write
23AE000
stack
page read and write
1860000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
49FE000
trusted library allocation
page read and write
D00000
trusted library allocation
page execute and read and write
5770000
trusted library allocation
page read and write
6D2E000
stack
page read and write
625000
heap
page read and write
57B0000
heap
page read and write
18AE000
stack
page read and write
6A41000
trusted library allocation
page read and write
620000
heap
page read and write
4AA3000
heap
page read and write
3251000
trusted library allocation
page read and write
3286000
trusted library allocation
page read and write
7420000
heap
page read and write
3605000
trusted library allocation
page read and write
15B7000
trusted library allocation
page read and write
5ADC000
stack
page read and write
1820000
trusted library allocation
page read and write
18F7000
heap
page read and write
6D5D000
trusted library allocation
page read and write
469C000
stack
page read and write
18C0000
trusted library allocation
page execute and read and write
18F0000
heap
page read and write
5090000
trusted library allocation
page read and write
865E000
stack
page read and write
56EA000
trusted library allocation
page read and write
24F0000
trusted library allocation
page read and write
CD7000
trusted library allocation
page execute and read and write
FCA000
stack
page read and write
8BE000
stack
page read and write
63AE000
stack
page read and write
183A000
trusted library allocation
page execute and read and write
15D0000
trusted library allocation
page read and write
5C7E000
stack
page read and write
697D000
stack
page read and write
4F60000
heap
page read and write
CDB000
trusted library allocation
page execute and read and write
49EE000
trusted library allocation
page read and write
12F9000
stack
page read and write
400000
remote allocation
page execute and read and write
1418000
heap
page read and write
5CBE000
stack
page read and write
8C0000
heap
page read and write
2550000
heap
page execute and read and write
5790000
trusted library allocation
page execute and read and write
4A20000
trusted library allocation
page read and write
235F000
trusted library allocation
page read and write
32C9000
trusted library allocation
page read and write
685F000
heap
page read and write
5714000
trusted library allocation
page read and write
50F0000
trusted library section
page read and write
D10000
heap
page read and write
841D000
stack
page read and write
24EE000
stack
page read and write
528C000
stack
page read and write
16F0000
heap
page read and write
16C0000
heap
page read and write
5110000
trusted library allocation
page read and write
2561000
trusted library allocation
page read and write
6D67000
trusted library allocation
page read and write
4F0D000
stack
page read and write
182D000
trusted library allocation
page execute and read and write
1378000
heap
page read and write
1845000
trusted library allocation
page execute and read and write
6A7E000
stack
page read and write
900000
trusted library allocation
page read and write
1842000
trusted library allocation
page read and write
2CA000
stack
page read and write
3567000
trusted library allocation
page read and write
4A12000
trusted library allocation
page read and write
5B3E000
stack
page read and write
910000
trusted library allocation
page read and write
6C2E000
stack
page read and write
4B60000
trusted library allocation
page read and write
5100000
trusted library section
page read and write
13EA000
heap
page read and write
1470000
heap
page read and write
CC6000
trusted library allocation
page execute and read and write
57A0000
heap
page read and write
50D0000
trusted library allocation
page read and write
4A06000
trusted library allocation
page read and write
13A7000
heap
page read and write
1814000
trusted library allocation
page read and write
4A70000
trusted library allocation
page read and write
1800000
trusted library allocation
page read and write
5C3E000
stack
page read and write
190000
unkown
page readonly
18E0000
trusted library allocation
page read and write
6D50000
trusted library allocation
page read and write
4A30000
trusted library allocation
page read and write
56DE000
trusted library allocation
page read and write
904000
trusted library allocation
page read and write
6C6E000
stack
page read and write
CF0000
trusted library allocation
page read and write
4F40000
trusted library allocation
page execute and read and write
8420000
heap
page read and write
CC2000
trusted library allocation
page read and write
7F1D000
stack
page read and write
1832000
trusted library allocation
page read and write
6E5000
heap
page read and write
6F2000
heap
page read and write
4E00000
heap
page read and write
683E000
stack
page read and write
49E0000
trusted library allocation
page read and write
31A8000
trusted library allocation
page read and write
56F1000
trusted library allocation
page read and write
1475000
heap
page read and write
13A4000
heap
page read and write
4A25000
trusted library allocation
page read and write
7FDA0000
trusted library allocation
page execute and read and write
920000
heap
page read and write
4D1E000
stack
page read and write
B2E000
stack
page read and write
1590000
trusted library allocation
page read and write
56F6000
trusted library allocation
page read and write
A2F000
stack
page read and write
65FD000
stack
page read and write
74D000
heap
page read and write
4A0D000
trusted library allocation
page read and write
329D000
trusted library allocation
page read and write
821E000
stack
page read and write
There are 239 hidden memdumps, click here to show them.