IOC Report
FAR.N_2430-240009934.exe

loading gif

Files

File Path
Type
Category
Malicious
FAR.N_2430-240009934.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\newfile.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\Idonna
data
dropped
C:\Users\user\AppData\Local\Temp\aut100A.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\autFBB.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\preconform
ASCII text, with very long lines (28674), with no line terminators
modified
C:\Users\user\AppData\Roaming\newfile\newfile.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\FAR.N_2430-240009934.exe
"C:\Users\user\Desktop\FAR.N_2430-240009934.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\FAR.N_2430-240009934.exe"
 malicious
C:\Users\user\AppData\Roaming\newfile\newfile.exe
"C:\Users\user\AppData\Roaming\newfile\newfile.exe"
malicious
C:\Users\user\AppData\Roaming\newfile\newfile.exe
"C:\Users\user\AppData\Roaming\newfile\newfile.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://r3.o.lencr.org0
unknown
http://mail.jmfresh.sg
unknown
https://account.dyn.com/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.
unknown
http://x1.i.lencr.org/0
unknown
http://r3.i.lencr.org/0#
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown
http://r3.i.lencr.org
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
mail.jmfresh.sg
101.100.239.36
 malicious
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
101.100.239.36
mail.jmfresh.sg
Singapore
malicious
208.95.112.1
ip-api.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
newfile
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
302E000
trusted library allocation
page read and write
 malicious
3EE0000
direct allocation
page read and write
 malicious
402000
system
page execute and read and write
 malicious
3001000
trusted library allocation
page read and write
 malicious
3051000
trusted library allocation
page read and write
 malicious
570E000
stack
page read and write
516E000
stack
page read and write
536D000
stack
page read and write
1640000
heap
page read and write
5616000
trusted library allocation
page read and write
41ED000
direct allocation
page read and write
14F2000
trusted library allocation
page read and write
42AE000
direct allocation
page read and write
3F20000
direct allocation
page read and write
16BF000
heap
page read and write
8E4000
unkown
page readonly
5673000
heap
page read and write
6524000
heap
page read and write
13DB000
stack
page read and write
4093000
direct allocation
page read and write
5622000
trusted library allocation
page read and write
560E000
trusted library allocation
page read and write
1970000
trusted library allocation
page read and write
3F70000
direct allocation
page read and write
701D1000
unkown
page execute read
17DE000
heap
page read and write
1510000
trusted library allocation
page read and write
3F70000
direct allocation
page read and write
13BE000
stack
page read and write
3300000
heap
page execute and read and write
16E9000
heap
page read and write
14A0000
heap
page read and write
3ED0000
direct allocation
page execute and read and write
15B0000
heap
page read and write
1530000
trusted library allocation
page read and write
58A0000
heap
page execute and read and write
14CD000
trusted library allocation
page execute and read and write
13C0000
heap
page read and write
4043000
direct allocation
page read and write
70DF000
stack
page read and write
1660000
heap
page read and write
1523000
trusted library allocation
page execute and read and write
3F70000
direct allocation
page read and write
16A0000
heap
page read and write
1668000
heap
page read and write
8E4000
unkown
page readonly
1634000
heap
page read and write
425E000
direct allocation
page read and write
42AE000
direct allocation
page read and write
169C000
heap
page read and write
13E5000
heap
page read and write
42AE000
direct allocation
page read and write
400000
system
page execute and read and write
5D60000
trusted library allocation
page read and write
17C0000
heap
page read and write
12B8000
heap
page read and write
1693000
heap
page read and write
57B0000
heap
page execute and read and write
5A3E000
stack
page read and write
1576000
heap
page read and write
14B0000
trusted library allocation
page read and write
5A7E000
stack
page read and write
162E000
stack
page read and write
14D5000
heap
page read and write
16A0000
heap
page read and write
1524000
trusted library allocation
page read and write
55F6000
trusted library allocation
page read and write
8E0000
unkown
page write copy
3060000
trusted library allocation
page read and write
6A70000
trusted library allocation
page read and write
12D9000
heap
page read and write
1540000
heap
page read and write
EC2000
unkown
page readonly
3271000
trusted library allocation
page read and write
1534000
trusted library allocation
page read and write
1684000
heap
page read and write
FC0000
heap
page read and write
4110000
direct allocation
page read and write
585F000
stack
page read and write
69F3000
trusted library allocation
page read and write
5AAF000
stack
page read and write
810000
unkown
page readonly
17DE000
heap
page read and write
13A0000
heap
page read and write
58FC000
stack
page read and write
17DD000
heap
page read and write
55FB000
trusted library allocation
page read and write
1840000
trusted library allocation
page execute and read and write
148D000
trusted library allocation
page execute and read and write
4FD8000
trusted library allocation
page read and write
5670000
heap
page read and write
13EF000
stack
page read and write
16E9000
heap
page read and write
1240000
heap
page read and write
4331000
trusted library allocation
page read and write
3F20000
direct allocation
page read and write
1474000
trusted library allocation
page read and write
15CA000
heap
page read and write
321C000
stack
page read and write
16CF000
heap
page read and write
1473000
trusted library allocation
page execute and read and write
5750000
heap
page execute and read and write
1668000
heap
page read and write
1548000
heap
page read and write
14FB000
trusted library allocation
page execute and read and write
1E5E000
stack
page read and write
5A9F000
stack
page read and write
679D000
stack
page read and write
1757000
trusted library allocation
page execute and read and write
17C0000
trusted library allocation
page execute and read and write
14D0000
heap
page read and write
6B40000
trusted library allocation
page execute and read and write
423D000
direct allocation
page read and write
13FF000
stack
page read and write
1830000
trusted library allocation
page read and write
3260000
heap
page execute and read and write
14EF000
stack
page read and write
17CF000
heap
page read and write
16DD000
heap
page read and write
1709000
heap
page read and write
5CBF000
stack
page read and write
425E000
direct allocation
page read and write
14F0000
trusted library allocation
page read and write
2FD1000
trusted library allocation
page read and write
7F6C0000
trusted library allocation
page execute and read and write
14B7000
trusted library allocation
page execute and read and write
14B0000
trusted library allocation
page read and write
17E0000
heap
page read and write
1650000
heap
page read and write
1480000
trusted library allocation
page read and write
40C0000
direct allocation
page read and write
EC0000
unkown
page readonly
1569000
heap
page read and write
5D50000
trusted library allocation
page read and write
811000
unkown
page execute read
6BDF000
stack
page read and write
16CF000
heap
page read and write
1770000
trusted library allocation
page read and write
2F8C000
stack
page read and write
3FD1000
trusted library allocation
page read and write
2F4E000
stack
page read and write
68DE000
stack
page read and write
599E000
stack
page read and write
ECA000
stack
page read and write
12E3000
heap
page read and write
135E000
stack
page read and write
17FE000
heap
page read and write
6A03000
trusted library allocation
page read and write
8AC000
unkown
page readonly
12B0000
heap
page read and write
41E9000
direct allocation
page read and write
302A000
trusted library allocation
page read and write
14E0000
trusted library allocation
page read and write
14DD000
trusted library allocation
page execute and read and write
2F90000
trusted library allocation
page read and write
139E000
stack
page read and write
14E2000
trusted library allocation
page read and write
16A0000
heap
page read and write
689F000
stack
page read and write
1630000
trusted library allocation
page execute and read and write
701ED000
unkown
page read and write
4093000
direct allocation
page read and write
304D000
trusted library allocation
page read and write
560A000
trusted library allocation
page read and write
582E000
stack
page read and write
1380000
heap
page read and write
17CF000
heap
page read and write
3320000
heap
page read and write
1250000
heap
page read and write
153D000
trusted library allocation
page execute and read and write
1960000
heap
page read and write
16E9000
heap
page read and write
1382000
heap
page read and write
185E000
stack
page read and write
593E000
stack
page read and write
5BAF000
stack
page read and write
6A6E000
stack
page read and write
17B3000
heap
page read and write
1260000
heap
page read and write
55F0000
trusted library allocation
page read and write
1750000
trusted library allocation
page read and write
701EF000
unkown
page readonly
16DD000
heap
page read and write
8AC000
unkown
page readonly
4239000
direct allocation
page read and write
16DE000
heap
page read and write
4033000
trusted library allocation
page read and write
1660000
heap
page read and write
1460000
heap
page read and write
5D67000
trusted library allocation
page read and write
FC9000
stack
page read and write
157D000
stack
page read and write
1990000
heap
page read and write
6C30000
trusted library allocation
page read and write
225E000
stack
page read and write
55FE000
trusted library allocation
page read and write
2FB0000
trusted library allocation
page read and write
1960000
trusted library allocation
page read and write
1698000
heap
page read and write
4239000
direct allocation
page read and write
FD0000
heap
page read and write
195E000
stack
page read and write
2E30000
trusted library allocation
page execute and read and write
4110000
direct allocation
page read and write
14D0000
trusted library allocation
page read and write
4271000
trusted library allocation
page read and write
8D2000
unkown
page readonly
15A5000
heap
page read and write
6A10000
trusted library allocation
page read and write
423D000
direct allocation
page read and write
14BB000
trusted library allocation
page execute and read and write
6A0D000
trusted library allocation
page read and write
13CE000
stack
page read and write
57AE000
stack
page read and write
69DD000
stack
page read and write
7140000
heap
page read and write
3034000
trusted library allocation
page read and write
16BF000
heap
page read and write
16EA000
heap
page read and write
17D0000
heap
page read and write
16E9000
heap
page read and write
6C20000
heap
page read and write
16E9000
heap
page read and write
14F5000
trusted library allocation
page execute and read and write
8DC000
unkown
page read and write
2FC0000
heap
page execute and read and write
4093000
direct allocation
page read and write
4239000
direct allocation
page read and write
1540000
heap
page read and write
17BE000
stack
page read and write
41ED000
direct allocation
page read and write
41ED000
direct allocation
page read and write
1230000
heap
page read and write
17EC000
heap
page read and write
175B000
trusted library allocation
page execute and read and write
57EE000
stack
page read and write
12FA000
stack
page read and write
561D000
trusted library allocation
page read and write
14E6000
trusted library allocation
page execute and read and write
2E2E000
stack
page read and write
ECA000
unkown
page readonly
DFA000
stack
page read and write
302C000
trusted library allocation
page read and write
EDC000
stack
page read and write
140E000
stack
page read and write
425E000
direct allocation
page read and write
3F20000
direct allocation
page read and write
2E40000
heap
page read and write
17FD000
heap
page read and write
1484000
trusted library allocation
page read and write
14F7000
trusted library allocation
page execute and read and write
810000
unkown
page readonly
423D000
direct allocation
page read and write
14EA000
trusted library allocation
page execute and read and write
5BBE000
stack
page read and write
15E0000
heap
page read and write
1257000
heap
page read and write
12E6000
heap
page read and write
3041000
trusted library allocation
page read and write
7110000
trusted library allocation
page execute and read and write
5630000
trusted library allocation
page read and write
17BF000
heap
page read and write
6520000
heap
page read and write
1684000
heap
page read and write
17FE000
heap
page read and write
4110000
direct allocation
page read and write
173F000
stack
page read and write
3059000
trusted library allocation
page read and write
17D0000
trusted library allocation
page read and write
40C0000
direct allocation
page read and write
41E9000
direct allocation
page read and write
701E6000
unkown
page readonly
FDA000
stack
page read and write
811000
unkown
page execute read
303F000
trusted library allocation
page read and write
1265000
heap
page read and write
3FF9000
trusted library allocation
page read and write
69F0000
trusted library allocation
page read and write
69E0000
trusted library allocation
page read and write
147D000
trusted library allocation
page execute and read and write
574E000
stack
page read and write
15DE000
stack
page read and write
8DC000
unkown
page write copy
57FC000
stack
page read and write
1370000
heap
page read and write
595F000
stack
page read and write
5602000
trusted library allocation
page read and write
195E000
stack
page read and write
144D000
stack
page read and write
1695000
heap
page read and write
182C000
stack
page read and write
701D0000
unkown
page readonly
5611000
trusted library allocation
page read and write
2FA0000
trusted library allocation
page read and write
5B7E000
stack
page read and write
1693000
heap
page read and write
15E0000
trusted library allocation
page read and write
16E9000
heap
page read and write
1510000
trusted library allocation
page read and write
5D40000
heap
page read and write
1850000
heap
page read and write
6FDE000
stack
page read and write
1564000
heap
page read and write
152D000
trusted library allocation
page execute and read and write
59AE000
stack
page read and write
8D2000
unkown
page readonly
1630000
heap
page read and write
6A1F000
trusted library allocation
page read and write
5680000
heap
page read and write
13E0000
heap
page read and write
1240000
heap
page read and write
3331000
trusted library allocation
page read and write
23F0000
heap
page read and write
1520000
heap
page read and write
4043000
direct allocation
page read and write
16E9000
heap
page read and write
4043000
direct allocation
page read and write
40C0000
direct allocation
page read and write
173B000
heap
page read and write
14C0000
trusted library allocation
page read and write
14C4000
trusted library allocation
page read and write
1460000
trusted library allocation
page read and write
14C3000
trusted library allocation
page execute and read and write
41E9000
direct allocation
page read and write
6A20000
trusted library allocation
page execute and read and write
15C0000
heap
page read and write
F5C000
stack
page read and write
542E000
stack
page read and write
15BE000
stack
page read and write
16E9000
heap
page read and write
1980000
trusted library allocation
page execute and read and write
There are 321 hidden memdumps, click here to show them.