IOC Report
2.jpg.exe

loading gif

Files

File Path
Type
Category
Malicious
2.jpg.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\Desktop\localfile_638491169974164363.txt
ASCII text, with very long lines (10240), with no line terminators
dropped
C:\Users\user\Desktop\localfile_638491175959284389.txt
ASCII text, with very long lines (1474), with no line terminators
modified

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\2.jpg.exe
"C:\Users\user\Desktop\2.jpg.exe"
 malicious

URLs

Name
IP
Malicious
http://8.218.236.5:8089/1.txt
8.218.236.5
 malicious
http://8.218.236.5/
unknown
 malicious
http://8.218.236.5:8062/g.pixel
8.218.236.5
 malicious
http://8.218.236.5:8062/j9sF
8.218.236.5
 malicious
http://8.218.236.5:8089/0.txt
8.218.236.5
 malicious
http://8.218.236.5/j9sF
malicious
http://8.218.236.5:None/j9sF
malicious
http://8.218.236.5:8062/g.pixelHeartbeatTimesg
unknown
http://8.218.236.5:8062/j9sF6
unknown
http://8.218.236.5:8062/g.pixelnkMonitoringM
unknown
http://8.218.236.5:8089
unknown
http://8.218.236.5:8089/0.txtlB
unknown
http://8.218.236.5:8089/1.txtd
unknown
http://8.218.236.5:8062/g.pixelitoringKillbit
unknown
http://8.218.236.5:8062/g.pixelitoringKillbitS
unknown
http://8.218.236.5:8089/0.txtP
unknown
http://8.218.236.5:8089/1.txtP
unknown
http://8.218.236.5:8089/1.txter
unknown
http://127.0.0.1:%u/
unknown
http://8.218.236.5:8062/g.pixelnkMonitoringx
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://8.218.236.5:8089/0.txtC
unknown
http://8.218.236.5:8089t-
unknown
There are 13 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
8.218.236.5
unknown
Singapore
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\2_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
26D8000
trusted library allocation
page read and write
 malicious
292000
unkown
page readonly
 malicious
5F30000
direct allocation
page execute and read and write
 malicious
6360000
direct allocation
page execute and read and write
 malicious
2621000
trusted library allocation
page read and write
 malicious
6760000
direct allocation
page execute and read and write
 malicious
917000
heap
page read and write
607D000
stack
page read and write
9B7000
heap
page read and write
5E1E000
stack
page read and write
88B000
trusted library allocation
page execute and read and write
5CE0000
heap
page read and write
4CEF000
stack
page read and write
26A2000
trusted library allocation
page read and write
2580000
trusted library allocation
page read and write
267F000
trusted library allocation
page read and write
6F8000
stack
page read and write
9D5000
heap
page read and write
26B2000
trusted library allocation
page read and write
87A000
trusted library allocation
page execute and read and write
960000
heap
page read and write
268D000
trusted library allocation
page read and write
5D04000
heap
page read and write
4F7D000
stack
page read and write
E60000
heap
page read and write
26A8000
trusted library allocation
page read and write
3EE000
stack
page read and write
6794000
direct allocation
page execute and read and write
25A0000
heap
page execute and read and write
2600000
trusted library allocation
page read and write
5D1E000
heap
page read and write
9C4000
heap
page read and write
5D46000
heap
page read and write
5CD0000
heap
page read and write
4CAD000
stack
page read and write
4CF0000
heap
page execute and read and write
E67000
heap
page read and write
A0D000
heap
page read and write
ACE000
stack
page read and write
854000
trusted library allocation
page read and write
579D000
stack
page read and write
99E000
heap
page read and write
47BE000
stack
page read and write
26A4000
trusted library allocation
page read and write
50BE000
stack
page read and write
290000
unkown
page readonly
900000
trusted library allocation
page read and write
390000
heap
page read and write
5F1F000
stack
page read and write
8F0000
trusted library allocation
page execute and read and write
6394000
direct allocation
page execute and read and write
67B0000
heap
page read and write
99A000
heap
page read and write
5F7C000
stack
page read and write
68E4000
heap
page read and write
872000
trusted library allocation
page read and write
51BD000
stack
page read and write
A0A000
heap
page read and write
5CF5000
heap
page read and write
8A0000
trusted library allocation
page read and write
267C000
trusted library allocation
page read and write
6796000
direct allocation
page execute and read and write
68E2000
heap
page read and write
2679000
trusted library allocation
page read and write
52FD000
stack
page read and write
631D000
stack
page read and write
A73000
heap
page read and write
910000
heap
page read and write
A17000
heap
page read and write
60BE000
stack
page read and write
95E000
stack
page read and write
61BE000
stack
page read and write
5D0A000
heap
page read and write
679F000
direct allocation
page execute and read and write
860000
trusted library allocation
page read and write
507F000
stack
page read and write
C0E000
stack
page read and write
85D000
trusted library allocation
page execute and read and write
3A0000
heap
page read and write
26C1000
trusted library allocation
page read and write
830000
trusted library allocation
page read and write
54DE000
stack
page read and write
2686000
trusted library allocation
page read and write
569E000
stack
page read and write
68E8000
heap
page read and write
5CC0000
heap
page read and write
51FD000
stack
page read and write
68D0000
heap
page read and write
2610000
heap
page read and write
9D1000
heap
page read and write
A5B000
heap
page read and write
877000
trusted library allocation
page execute and read and write
887000
trusted library allocation
page execute and read and write
845000
heap
page read and write
257E000
stack
page read and write
80E000
stack
page read and write
A6A000
heap
page read and write
5CBD000
stack
page read and write
621D000
stack
page read and write
3621000
trusted library allocation
page read and write
5F20000
trusted library section
page read and write
990000
heap
page read and write
68E0000
heap
page read and write
2681000
trusted library allocation
page read and write
5D16000
heap
page read and write
268F000
trusted library allocation
page read and write
853000
trusted library allocation
page execute and read and write
5BBE000
stack
page read and write
32C000
stack
page read and write
8EE000
stack
page read and write
840000
heap
page read and write
850000
trusted library allocation
page read and write
882000
trusted library allocation
page read and write
679D000
direct allocation
page execute and read and write
26AE000
trusted library allocation
page read and write
55DD000
stack
page read and write
There are 106 hidden memdumps, click here to show them.