IOC Report
SecuriteInfo.com.Trojan.DownLoader46.57266.31234.98.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Trojan.DownLoader46.57266.31234.98.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.DownLoader46.57266.31234.98.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.57266.31234.98.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.57266.31234.98.exe"
 malicious
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.57266.31234.98.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownLoader46.57266.31234.98.exe"
 malicious

URLs

Name
IP
Malicious
https://github.com/mgravell/protobuf-net
unknown
http://juytlioojbni.duckdns.org
unknown
http://juytlioojbni.duckdns.org/byfronbypass.html/css/mss/Zxbnbw.wav
91.92.246.15
https://github.com/mgravell/protobuf-neti
unknown
https://stackoverflow.com/q/14436606/23354
unknown
https://github.com/mgravell/protobuf-netJ
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://stackoverflow.com/q/11564914/23354;
unknown
https://stackoverflow.com/q/2152978/23354
unknown

Domains

Name
IP
Malicious
juytlioojbni.duckdns.org
91.92.246.15
 malicious
gerwgewg5.duckdns.org
91.92.246.79
 malicious

IPs

IP
Domain
Country
Malicious
91.92.246.15
juytlioojbni.duckdns.org
Bulgaria
malicious
91.92.246.79
gerwgewg5.duckdns.org
Bulgaria
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SecuriteInfo_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
6CB0000
trusted library section
page read and write
 malicious
28E4000
trusted library allocation
page read and write
 malicious
5DD0000
trusted library section
page read and write
 malicious
2F17000
trusted library allocation
page read and write
 malicious
2E6C000
trusted library allocation
page read and write
 malicious
7C2000
remote allocation
page execute and read and write
 malicious
2849000
trusted library allocation
page read and write
 malicious
5190000
trusted library section
page read and write
 malicious
3BF1000
trusted library allocation
page read and write
 malicious
4F10000
trusted library section
page read and write
 malicious
3C86000
trusted library allocation
page read and write
 malicious
3FD0000
trusted library allocation
page read and write
 malicious
3EA5000
trusted library allocation
page read and write
 malicious
48C1000
trusted library allocation
page read and write
 malicious
3D31000
trusted library allocation
page read and write
 malicious
37D1000
trusted library allocation
page read and write
 malicious
950000
heap
page read and write
2E2D000
trusted library allocation
page read and write
12FE000
stack
page read and write
27C0000
heap
page read and write
E24000
trusted library allocation
page read and write
E10000
trusted library allocation
page read and write
2C6A000
trusted library allocation
page read and write
2E1A000
trusted library allocation
page read and write
5190000
trusted library allocation
page read and write
2C68000
trusted library allocation
page read and write
2824000
trusted library allocation
page read and write
5440000
trusted library allocation
page execute and read and write
E52000
trusted library allocation
page read and write
2809000
trusted library allocation
page read and write
E90000
trusted library allocation
page read and write
6FC6000
trusted library allocation
page read and write
EA0000
heap
page read and write
2F11000
trusted library allocation
page read and write
2C53000
trusted library allocation
page read and write
A37000
heap
page read and write
E9E000
stack
page read and write
5BD0000
trusted library allocation
page read and write
2DE4000
trusted library allocation
page read and write
9E2000
trusted library allocation
page read and write
2C6E000
trusted library allocation
page read and write
8EC000
stack
page read and write
2E4A000
trusted library allocation
page read and write
5490000
heap
page read and write
5CC0000
trusted library allocation
page read and write
2CB9000
trusted library allocation
page read and write
533E000
stack
page read and write
996000
heap
page read and write
2E03000
trusted library allocation
page read and write
2DE6000
trusted library allocation
page read and write
E40000
trusted library allocation
page read and write
F07000
heap
page read and write
2C71000
trusted library allocation
page read and write
5ABD000
heap
page read and write
4D00000
heap
page execute and read and write
2C9E000
trusted library allocation
page read and write
5FB0000
trusted library section
page read and write
6FA0000
trusted library allocation
page read and write
280F000
trusted library allocation
page read and write
2E33000
trusted library allocation
page read and write
E20000
trusted library allocation
page read and write
5B90000
trusted library allocation
page read and write
10DE000
stack
page read and write
2C9C000
trusted library allocation
page read and write
2E0E000
trusted library allocation
page read and write
2E16000
trusted library allocation
page read and write
2C51000
trusted library allocation
page read and write
4C30000
trusted library allocation
page read and write
5AA9000
heap
page read and write
EE8000
heap
page read and write
2E53000
trusted library allocation
page read and write
27CD000
heap
page read and write
CCE000
stack
page read and write
5A80000
heap
page read and write
11DE000
stack
page read and write
4C10000
trusted library allocation
page execute and read and write
9B0000
trusted library allocation
page read and write
788000
stack
page read and write
5BE0000
trusted library allocation
page execute and read and write
51FE000
stack
page read and write
E3D000
trusted library allocation
page execute and read and write
282E000
trusted library allocation
page read and write
2C98000
trusted library allocation
page read and write
7C0000
remote allocation
page execute and read and write
E5B000
trusted library allocation
page execute and read and write
2CBF000
trusted library allocation
page read and write
2C66000
trusted library allocation
page read and write
5240000
trusted library allocation
page read and write
2CA0000
trusted library allocation
page read and write
D90000
heap
page read and write
5A7E000
stack
page read and write
2DFB000
trusted library allocation
page read and write
930000
heap
page read and write
700B000
trusted library allocation
page read and write
12A0000
trusted library allocation
page read and write
541E000
stack
page read and write
2C64000
trusted library allocation
page read and write
EA0000
heap
page read and write
E2D000
trusted library allocation
page execute and read and write
2E2F000
trusted library allocation
page read and write
6FCB000
trusted library allocation
page read and write
2C56000
trusted library allocation
page read and write
2CA4000
trusted library allocation
page read and write
4F0F000
stack
page read and write
2DE0000
trusted library allocation
page read and write
282A000
trusted library allocation
page read and write
2E4C000
trusted library allocation
page read and write
48CE000
stack
page read and write
593F000
stack
page read and write
5DC0000
trusted library allocation
page execute and read and write
6FD0000
trusted library allocation
page read and write
E4A000
trusted library allocation
page execute and read and write
5D39000
trusted library allocation
page read and write
53DE000
stack
page read and write
D60000
trusted library allocation
page execute and read and write
A00000
heap
page read and write
4C50000
trusted library allocation
page read and write
2C4B000
trusted library allocation
page read and write
4C40000
trusted library allocation
page read and write
7019000
trusted library allocation
page read and write
6FB0000
trusted library allocation
page read and write
711E000
stack
page read and write
279E000
stack
page read and write
5D10000
trusted library allocation
page read and write
2E46000
trusted library allocation
page read and write
ABE000
heap
page read and write
F21000
heap
page read and write
2C1F000
trusted library allocation
page read and write
4C38000
trusted library allocation
page read and write
FBB000
heap
page read and write
DF0000
heap
page read and write
4CDE000
stack
page read and write
2DE2000
trusted library allocation
page read and write
5F80000
trusted library allocation
page execute and read and write
2CBD000
trusted library allocation
page read and write
27D1000
trusted library allocation
page read and write
2C9A000
trusted library allocation
page read and write
F93000
heap
page read and write
2C4D000
trusted library allocation
page read and write
9C0000
trusted library allocation
page read and write
2750000
heap
page execute and read and write
5BC0000
trusted library allocation
page read and write
D35000
heap
page read and write
6FC0000
trusted library allocation
page read and write
5BB0000
trusted library allocation
page read and write
2DDC000
trusted library allocation
page read and write
2DFD000
trusted library allocation
page read and write
5F90000
trusted library allocation
page execute and read and write
2BAE000
stack
page read and write
822000
unkown
page readonly
51B0000
heap
page execute and read and write
125E000
stack
page read and write
2E14000
trusted library allocation
page read and write
2E48000
trusted library allocation
page read and write
5040000
trusted library section
page read and write
283F000
trusted library allocation
page read and write
C50000
heap
page read and write
5D36000
trusted library allocation
page read and write
4C20000
trusted library allocation
page read and write
2C7F000
trusted library allocation
page read and write
A08000
heap
page read and write
2C6C000
trusted library allocation
page read and write
4C4D000
trusted library allocation
page read and write
850000
unkown
page readonly
547D000
stack
page read and write
5FA0000
trusted library allocation
page execute and read and write
2BE1000
trusted library allocation
page read and write
68C000
stack
page read and write
D8E000
stack
page read and write
D40000
heap
page read and write
1290000
trusted library allocation
page execute and read and write
61E0000
trusted library allocation
page read and write
5480000
heap
page read and write
5AFF000
heap
page read and write
2CBB000
trusted library allocation
page read and write
1280000
trusted library allocation
page read and write
2CB7000
trusted library allocation
page read and write
2DFF000
trusted library allocation
page read and write
4160000
trusted library allocation
page read and write
5C10000
trusted library allocation
page read and write
2C87000
trusted library allocation
page read and write
2E60000
trusted library allocation
page read and write
ED0000
trusted library allocation
page read and write
5230000
trusted library allocation
page execute and read and write
DCE000
stack
page read and write
1260000
trusted library allocation
page read and write
2C81000
trusted library allocation
page read and write
2C3D000
trusted library allocation
page read and write
2DCB000
trusted library allocation
page read and write
6B90000
trusted library allocation
page read and write
4297000
trusted library allocation
page read and write
2C47000
trusted library allocation
page read and write
2E35000
trusted library allocation
page read and write
567E000
stack
page read and write
280B000
trusted library allocation
page read and write
597E000
stack
page read and write
2811000
trusted library allocation
page read and write
E80000
trusted library allocation
page execute and read and write
583E000
stack
page read and write
7000000
trusted library allocation
page read and write
6FD4000
trusted library allocation
page read and write
2807000
trusted library allocation
page read and write
2E18000
trusted library allocation
page read and write
2841000
trusted library allocation
page read and write
9B3000
trusted library allocation
page execute and read and write
820000
unkown
page readonly
5D40000
trusted library allocation
page read and write
4C70000
trusted library section
page read and write
2C8A000
trusted library allocation
page read and write
9EB000
trusted library allocation
page execute and read and write
2E05000
trusted library allocation
page read and write
2E1F000
trusted library allocation
page read and write
2C85000
trusted library allocation
page read and write
EE0000
heap
page read and write
2CB3000
trusted library allocation
page read and write
55BD000
stack
page read and write
2DCE000
trusted library allocation
page read and write
9D2000
trusted library allocation
page read and write
92E000
stack
page read and write
2847000
trusted library allocation
page read and write
52FF000
stack
page read and write
9E7000
stack
page read and write
D5E000
stack
page read and write
8E0000
heap
page read and write
A2B000
heap
page read and write
A6A000
heap
page read and write
2DF9000
trusted library allocation
page read and write
5D30000
trusted library allocation
page read and write
ABA000
heap
page read and write
27B0000
trusted library allocation
page read and write
280D000
trusted library allocation
page read and write
D80000
trusted library allocation
page read and write
2E12000
trusted library allocation
page read and write
2813000
trusted library allocation
page read and write
5CC9000
trusted library allocation
page read and write
4C60000
heap
page read and write
5B80000
trusted library allocation
page read and write
2843000
trusted library allocation
page read and write
5F00000
trusted library section
page read and write
56FE000
stack
page read and write
557E000
stack
page read and write
E42000
trusted library allocation
page read and write
2C83000
trusted library allocation
page read and write
5BA0000
trusted library allocation
page read and write
1270000
trusted library allocation
page read and write
2DDE000
trusted library allocation
page read and write
4CA0000
trusted library allocation
page execute and read and write
9DA000
trusted library allocation
page execute and read and write
56BE000
stack
page read and write
6FF5000
trusted library allocation
page read and write
316F000
trusted library allocation
page read and write
127B000
trusted library allocation
page read and write
9BD000
trusted library allocation
page execute and read and write
27FF000
trusted library allocation
page read and write
5C00000
trusted library allocation
page read and write
E46000
trusted library allocation
page execute and read and write
283D000
trusted library allocation
page read and write
2CB5000
trusted library allocation
page read and write
9D0000
trusted library allocation
page read and write
6FE1000
trusted library allocation
page read and write
57FE000
stack
page read and write
6FDE000
trusted library allocation
page read and write
4C90000
trusted library allocation
page read and write
2C62000
trusted library allocation
page read and write
543E000
stack
page read and write
28CE000
trusted library allocation
page read and write
990000
heap
page read and write
5D20000
trusted library allocation
page read and write
6010000
trusted library allocation
page read and write
3BEB000
trusted library allocation
page read and write
5F50000
trusted library allocation
page execute and read and write
D30000
heap
page read and write
9E7000
trusted library allocation
page execute and read and write
5090000
heap
page read and write
2816000
trusted library allocation
page read and write
6FCE000
trusted library allocation
page read and write
AD8000
heap
page read and write
2DEA000
trusted library allocation
page read and write
4C80000
trusted library allocation
page read and write
D1E000
stack
page read and write
AC2000
heap
page read and write
282C000
trusted library allocation
page read and write
61A0000
trusted library allocation
page execute and read and write
2BD0000
heap
page execute and read and write
E23000
trusted library allocation
page execute and read and write
1300000
heap
page read and write
5487000
heap
page read and write
121E000
stack
page read and write
5D00000
trusted library allocation
page execute and read and write
2C49000
trusted library allocation
page read and write
2C90000
trusted library allocation
page read and write
3BE1000
trusted library allocation
page read and write
12B0000
trusted library allocation
page read and write
9A0000
trusted library allocation
page read and write
5BF0000
trusted library allocation
page read and write
E30000
trusted library allocation
page read and write
F1F000
heap
page read and write
2E37000
trusted library allocation
page read and write
6FE7000
trusted library allocation
page read and write
EEE000
heap
page read and write
2E50000
trusted library allocation
page read and write
EB0000
heap
page read and write
E57000
trusted library allocation
page execute and read and write
AC6000
heap
page read and write
7010000
trusted library allocation
page read and write
D70000
trusted library allocation
page read and write
577E000
stack
page read and write
9D6000
trusted library allocation
page execute and read and write
5F70000
trusted library allocation
page read and write
2E1C000
trusted library allocation
page read and write
2C4F000
trusted library allocation
page read and write
9B4000
trusted library allocation
page read and write
41AA000
trusted library allocation
page read and write
7009000
trusted library allocation
page read and write
2E4E000
trusted library allocation
page read and write
2831000
trusted library allocation
page read and write
There are 306 hidden memdumps, click here to show them.