IOC Report
FAR.N#U00b02430-24000993.exe

loading gif

Files

File Path
Type
Category
Malicious
FAR.N#U00b02430-24000993.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\newfile.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\autE4C3.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\autE522.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\iodization
ASCII text, with very long lines (29698), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\jailless
data
dropped
C:\Users\user\AppData\Roaming\newfile\newfile.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe
"C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\FAR.N#U00b02430-24000993.exe"
 malicious
C:\Users\user\AppData\Roaming\newfile\newfile.exe
"C:\Users\user\AppData\Roaming\newfile\newfile.exe"
malicious
C:\Users\user\AppData\Roaming\newfile\newfile.exe
"C:\Users\user\AppData\Roaming\newfile\newfile.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://ip-api.com/line/?fields=hostingg
unknown
http://mail.cash4cars.nz
unknown
https://account.dyn.com/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
mail.cash4cars.nz
114.142.162.17
 malicious
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
114.142.162.17
mail.cash4cars.nz
Australia
malicious
208.95.112.1
ip-api.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
newfile
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
system
page execute and read and write
 malicious
31E1000
trusted library allocation
page read and write
 malicious
320E000
trusted library allocation
page read and write
 malicious
1560000
direct allocation
page read and write
 malicious
6990000
trusted library allocation
page read and write
30FC000
stack
page read and write
1488000
heap
page read and write
8F2000
heap
page read and write
42DE000
direct allocation
page read and write
1024000
trusted library allocation
page read and write
570E000
trusted library allocation
page read and write
570A000
trusted library allocation
page read and write
426D000
direct allocation
page read and write
56FE000
trusted library allocation
page read and write
321E000
trusted library allocation
page read and write
6D1000
unkown
page execute read
89B000
trusted library allocation
page execute and read and write
172A000
heap
page read and write
1550000
heap
page read and write
16C6000
trusted library allocation
page execute and read and write
D9D000
stack
page read and write
3FA0000
direct allocation
page read and write
426D000
direct allocation
page read and write
9F0000
heap
page execute and read and write
1023000
trusted library allocation
page execute and read and write
6970000
trusted library allocation
page read and write
13E7000
heap
page read and write
234C000
stack
page read and write
1010000
trusted library allocation
page read and write
16C2000
trusted library allocation
page read and write
10A0000
heap
page execute and read and write
E18000
heap
page read and write
16BB000
heap
page read and write
C3C000
stack
page read and write
40C3000
direct allocation
page read and write
86F000
stack
page read and write
16F0000
trusted library allocation
page read and write
79C000
unkown
page write copy
13B8000
heap
page read and write
163E000
heap
page read and write
46C000
stack
page read and write
53AE000
stack
page read and write
3FA0000
direct allocation
page read and write
696E000
stack
page read and write
4A8E000
stack
page read and write
163F000
heap
page read and write
163E000
heap
page read and write
6BD0000
trusted library allocation
page read and write
1753000
heap
page read and write
1310000
heap
page read and write
14AC000
heap
page read and write
5260000
heap
page execute and read and write
1090000
trusted library allocation
page read and write
15D6000
heap
page read and write
1753000
heap
page read and write
163E000
heap
page read and write
163E000
heap
page read and write
5180000
trusted library allocation
page execute and read and write
4CEC000
stack
page read and write
874000
trusted library allocation
page read and write
5711000
trusted library allocation
page read and write
16D5000
trusted library allocation
page execute and read and write
52AD000
stack
page read and write
13BF000
stack
page read and write
69A3000
trusted library allocation
page read and write
15F1000
heap
page read and write
5C8D000
stack
page read and write
6980000
trusted library allocation
page read and write
13CF000
stack
page read and write
DFD000
heap
page read and write
15E6000
heap
page read and write
3180000
trusted library allocation
page read and write
2371000
trusted library allocation
page read and write
16A2000
heap
page read and write
8C0000
trusted library allocation
page execute and read and write
DB5000
heap
page read and write
DB0000
heap
page read and write
426D000
direct allocation
page read and write
792000
unkown
page readonly
163E000
heap
page read and write
1816000
heap
page read and write
15F2000
heap
page read and write
488E000
stack
page read and write
16D2000
trusted library allocation
page read and write
6993000
trusted library allocation
page read and write
7A4000
unkown
page readonly
14D0000
trusted library allocation
page read and write
2ABE000
stack
page read and write
897000
trusted library allocation
page execute and read and write
1633000
heap
page read and write
9AA000
unkown
page readonly
4D8E000
stack
page read and write
31B1000
trusted library allocation
page read and write
1730000
heap
page read and write
42DE000
direct allocation
page read and write
426D000
direct allocation
page read and write
6F70000
trusted library allocation
page execute and read and write
4B80000
heap
page execute and read and write
6BC0000
heap
page read and write
4269000
direct allocation
page read and write
740000
trusted library allocation
page read and write
5130000
heap
page read and write
12F8000
stack
page read and write
14E5000
heap
page read and write
87D000
trusted library allocation
page execute and read and write
1320000
heap
page read and write
15F1000
heap
page read and write
569000
stack
page read and write
1810000
heap
page read and write
42DE000
direct allocation
page read and write
13B0000
heap
page read and write
93F000
heap
page read and write
DA0000
heap
page read and write
64DE000
heap
page read and write
3214000
trusted library allocation
page read and write
172F000
heap
page read and write
686E000
stack
page read and write
3FA0000
direct allocation
page read and write
700000
heap
page read and write
21AF000
stack
page read and write
4213000
trusted library allocation
page read and write
FA9000
stack
page read and write
1DAE000
stack
page read and write
792000
unkown
page readonly
9D0000
heap
page read and write
57EE000
stack
page read and write
11BF000
stack
page read and write
6B7F000
stack
page read and write
163E000
heap
page read and write
5830000
heap
page read and write
4269000
direct allocation
page read and write
10B0000
heap
page read and write
A40000
trusted library allocation
page read and write
5840000
heap
page read and write
2C0F000
stack
page read and write
6D0000
unkown
page readonly
3FA0000
direct allocation
page read and write
76C000
unkown
page readonly
1057000
trusted library allocation
page execute and read and write
5716000
trusted library allocation
page read and write
40C3000
direct allocation
page read and write
2350000
trusted library allocation
page execute and read and write
D50000
heap
page read and write
6977000
trusted library allocation
page read and write
498F000
stack
page read and write
14C3000
trusted library allocation
page execute and read and write
6D0000
unkown
page readonly
40C3000
direct allocation
page read and write
FEE000
stack
page read and write
14A3000
heap
page read and write
163E000
heap
page read and write
A3E000
stack
page read and write
2AFE000
stack
page read and write
4269000
direct allocation
page read and write
15B8000
heap
page read and write
2360000
heap
page read and write
3110000
trusted library allocation
page read and write
54EE000
stack
page read and write
4140000
direct allocation
page read and write
5843000
heap
page read and write
16DD000
heap
page read and write
230F000
stack
page read and write
5A4C000
stack
page read and write
14CD000
trusted library allocation
page execute and read and write
3C50000
heap
page read and write
DE0000
heap
page read and write
760000
heap
page read and write
69B0000
trusted library allocation
page read and write
16C0000
trusted library allocation
page read and write
4140000
direct allocation
page read and write
4B0E000
stack
page read and write
54AE000
stack
page read and write
4DEE000
stack
page read and write
105B000
trusted library allocation
page execute and read and write
9A0000
unkown
page readonly
A60000
heap
page read and write
64B8000
heap
page read and write
576C000
stack
page read and write
1360000
heap
page read and write
40C3000
direct allocation
page read and write
3C11000
trusted library allocation
page read and write
E57000
heap
page read and write
29BE000
stack
page read and write
15F1000
heap
page read and write
15ED000
heap
page read and write
753000
trusted library allocation
page execute and read and write
E09000
heap
page read and write
42DE000
direct allocation
page read and write
1631000
heap
page read and write
15B0000
heap
page read and write
754000
trusted library allocation
page read and write
582E000
stack
page read and write
4269000
direct allocation
page read and write
7A4000
unkown
page readonly
3130000
heap
page execute and read and write
7A0000
unkown
page write copy
8D8000
heap
page read and write
400000
system
page execute and read and write
30BE000
stack
page read and write
1540000
direct allocation
page execute and read and write
1030000
trusted library allocation
page read and write
5D0000
heap
page read and write
173E000
stack
page read and write
682E000
stack
page read and write
5702000
trusted library allocation
page read and write
15E4000
heap
page read and write
4140000
direct allocation
page read and write
56FB000
trusted library allocation
page read and write
41B1000
trusted library allocation
page read and write
31A0000
heap
page read and write
1711000
heap
page read and write
1350000
heap
page read and write
1800000
trusted library allocation
page execute and read and write
14B0000
trusted library allocation
page read and write
1520000
heap
page read and write
524E000
stack
page read and write
DA0000
heap
page read and write
4C8F000
stack
page read and write
13E4000
heap
page read and write
6EE000
stack
page read and write
426D000
direct allocation
page read and write
2B00000
heap
page read and write
69C0000
trusted library allocation
page execute and read and write
2C11000
trusted library allocation
page read and write
6F0000
heap
page read and write
163E000
heap
page read and write
936000
heap
page read and write
4E8E000
stack
page read and write
15E4000
heap
page read and write
13EF000
stack
page read and write
672D000
stack
page read and write
57A0000
heap
page execute and read and write
7F750000
trusted library allocation
page execute and read and write
CEA000
stack
page read and write
1712000
heap
page read and write
56F6000
trusted library allocation
page read and write
536F000
stack
page read and write
5850000
heap
page read and write
40C3000
direct allocation
page read and write
13DB000
stack
page read and write
5B4E000
stack
page read and write
103D000
trusted library allocation
page execute and read and write
170E000
heap
page read and write
450D000
stack
page read and write
16DB000
trusted library allocation
page execute and read and write
56F0000
trusted library allocation
page read and write
5722000
trusted library allocation
page read and write
DE8000
heap
page read and write
16CA000
trusted library allocation
page execute and read and write
1611000
heap
page read and write
165E000
heap
page read and write
4269000
direct allocation
page read and write
5DF0000
trusted library allocation
page read and write
1050000
trusted library allocation
page read and write
13FF000
stack
page read and write
79C000
unkown
page read and write
16F1000
heap
page read and write
4ACE000
stack
page read and write
3FA0000
direct allocation
page read and write
41D9000
trusted library allocation
page read and write
143A000
heap
page read and write
3FA0000
direct allocation
page read and write
55EE000
stack
page read and write
42DE000
direct allocation
page read and write
1034000
trusted library allocation
page read and write
E49000
heap
page read and write
1611000
heap
page read and write
571D000
trusted library allocation
page read and write
1621000
heap
page read and write
8F8000
heap
page read and write
1631000
heap
page read and write
64B0000
heap
page read and write
1748000
trusted library allocation
page read and write
6D1000
unkown
page execute read
16D0000
trusted library allocation
page read and write
3120000
trusted library allocation
page read and write
1631000
heap
page read and write
1750000
heap
page read and write
320C000
trusted library allocation
page read and write
6AE0000
trusted library allocation
page execute and read and write
17E0000
heap
page read and write
3371000
trusted library allocation
page read and write
16D7000
trusted library allocation
page execute and read and write
1721000
heap
page read and write
4140000
direct allocation
page read and write
42DE000
direct allocation
page read and write
3C54000
heap
page read and write
1621000
heap
page read and write
14DD000
trusted library allocation
page execute and read and write
870000
trusted library allocation
page read and write
14E0000
heap
page read and write
22C0000
heap
page read and write
163E000
heap
page read and write
4269000
direct allocation
page read and write
6A0E000
stack
page read and write
6AB0000
trusted library allocation
page read and write
5D8E000
stack
page read and write
6F5000
heap
page read and write
D3A000
stack
page read and write
1070000
trusted library allocation
page read and write
426D000
direct allocation
page read and write
14C0000
trusted library allocation
page read and write
905000
heap
page read and write
1350000
trusted library allocation
page read and write
102D000
trusted library allocation
page execute and read and write
1080000
trusted library allocation
page execute and read and write
5C4F000
stack
page read and write
E46000
heap
page read and write
4140000
direct allocation
page read and write
14C4000
trusted library allocation
page read and write
9A2000
unkown
page readonly
173F000
heap
page read and write
8D0000
heap
page read and write
4140000
direct allocation
page read and write
75D000
trusted library allocation
page execute and read and write
1618000
heap
page read and write
1721000
heap
page read and write
1730000
heap
page read and write
320A000
trusted library allocation
page read and write
DC0000
heap
page read and write
69AD000
trusted library allocation
page read and write
76C000
unkown
page readonly
1752000
heap
page read and write
6F90000
heap
page read and write
DED000
stack
page read and write
E02000
heap
page read and write
A50000
trusted library allocation
page read and write
8ED000
heap
page read and write
40C3000
direct allocation
page read and write
64B5000
heap
page read and write
3100000
trusted library allocation
page read and write
There are 321 hidden memdumps, click here to show them.