IOC Report
Ship Docs_ CI_BL_HBL_.exe

loading gif

Files

File Path
Type
Category
Malicious
Ship Docs_ CI_BL_HBL_.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\aut7C1F.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut7C5F.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\cerecloths
ASCII text, with very long lines (28720), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\nouses
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe
"C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.13.205
http://r3.o.lencr.org0
unknown
https://api.ipify.org
unknown
http://mail.myhydropowered.com
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown
http://r3.i.lencr.org/0
unknown
There are 2 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
mail.myhydropowered.com
131.226.2.60
 malicious
api.ipify.org
104.26.13.205
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
131.226.2.60
mail.myhydropowered.com
United States
malicious
208.95.112.1
ip-api.com
United States
104.26.13.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
162000
system
page execute and read and write
 malicious
2415000
trusted library allocation
page read and write
 malicious
2438000
trusted library allocation
page read and write
 malicious
ED0000
direct allocation
page read and write
 malicious
5B2D000
stack
page read and write
156F000
heap
page read and write
AE0000
heap
page execute and read and write
4F4C000
stack
page read and write
3D00000
direct allocation
page read and write
3FCD000
direct allocation
page read and write
6A0000
trusted library allocation
page read and write
34F7000
trusted library allocation
page read and write
245D000
trusted library allocation
page read and write
48AE000
trusted library allocation
page read and write
6BD000
trusted library allocation
page execute and read and write
4BCC000
stack
page read and write
48BD000
trusted library allocation
page read and write
7F2B0000
trusted library allocation
page execute and read and write
94C000
stack
page read and write
48C2000
trusted library allocation
page read and write
5D4C000
stack
page read and write
239E000
stack
page read and write
58ED000
stack
page read and write
A053000
trusted library allocation
page read and write
25EA000
trusted library allocation
page read and write
5730000
heap
page read and write
23E5000
trusted library allocation
page read and write
60B0000
trusted library allocation
page read and write
3FCD000
direct allocation
page read and write
157D000
heap
page read and write
A01C000
trusted library allocation
page read and write
34B7000
trusted library allocation
page read and write
48E0000
trusted library allocation
page read and write
685D000
stack
page read and write
23F9000
trusted library allocation
page read and write
3EA0000
direct allocation
page read and write
A044000
trusted library allocation
page read and write
A02B000
trusted library allocation
page read and write
14F6000
heap
page read and write
3E23000
direct allocation
page read and write
145E000
stack
page read and write
103F000
unkown
page write copy
14F5000
heap
page read and write
35D7000
trusted library allocation
page read and write
6E5000
trusted library allocation
page execute and read and write
403E000
direct allocation
page read and write
1048000
unkown
page readonly
3617000
trusted library allocation
page read and write
3FCD000
direct allocation
page read and write
160000
system
page execute and read and write
2502000
trusted library allocation
page read and write
655C000
stack
page read and write
3E23000
direct allocation
page read and write
6D2000
trusted library allocation
page read and write
159C000
heap
page read and write
5F00000
trusted library allocation
page read and write
33D9000
trusted library allocation
page read and write
3417000
trusted library allocation
page read and write
785000
heap
page read and write
2401000
trusted library allocation
page read and write
23B1000
trusted library allocation
page read and write
A067000
trusted library allocation
page read and write
5ECC000
stack
page read and write
25A3000
trusted library allocation
page read and write
3D00000
direct allocation
page read and write
5B7E000
stack
page read and write
3537000
trusted library allocation
page read and write
48D0000
trusted library allocation
page read and write
19E000
system
page execute and read and write
49C3000
heap
page read and write
403E000
direct allocation
page read and write
A049000
trusted library allocation
page read and write
15AC000
heap
page read and write
1554000
heap
page read and write
718000
heap
page read and write
7A7000
heap
page read and write
1553000
heap
page read and write
489B000
trusted library allocation
page read and write
84C000
unkown
page read and write
59EE000
stack
page read and write
14E6000
heap
page read and write
150D000
heap
page read and write
A062000
trusted library allocation
page read and write
23A0000
heap
page read and write
146B000
stack
page read and write
72E000
heap
page read and write
14F7000
heap
page read and write
5F60000
trusted library allocation
page read and write
5EE0000
trusted library allocation
page read and write
A026000
trusted library allocation
page read and write
F81000
unkown
page execute read
49AE000
stack
page read and write
77C0000
heap
page read and write
23FD000
trusted library allocation
page read and write
5670000
heap
page read and write
150D000
heap
page read and write
73A000
heap
page read and write
5710000
heap
page read and write
2651000
trusted library allocation
page read and write
39B0000
heap
page read and write
4890000
trusted library allocation
page read and write
3FC9000
direct allocation
page read and write
14B8000
heap
page read and write
1553000
heap
page read and write
159C000
heap
page read and write
3FCD000
direct allocation
page read and write
CA86000
trusted library allocation
page read and write
100F000
unkown
page readonly
5719000
heap
page read and write
8890000
heap
page read and write
489E000
trusted library allocation
page read and write
48AA000
trusted library allocation
page read and write
3497000
trusted library allocation
page read and write
1553000
heap
page read and write
3FC9000
direct allocation
page read and write
3D00000
direct allocation
page read and write
8E9000
stack
page read and write
454E000
stack
page read and write
49D0000
heap
page read and write
6CD000
trusted library allocation
page execute and read and write
665D000
stack
page read and write
745000
heap
page read and write
5E4C000
stack
page read and write
A071000
trusted library allocation
page read and write
3FCD000
direct allocation
page read and write
8E89000
trusted library allocation
page read and write
68A0000
heap
page read and write
4D0E000
stack
page read and write
3FC9000
direct allocation
page read and write
AF6000
heap
page read and write
9E0000
heap
page read and write
6030000
trusted library allocation
page execute and read and write
1043000
unkown
page write copy
DAAE000
stack
page read and write
5F5C000
stack
page read and write
148C000
stack
page read and write
9DE000
stack
page read and write
150D000
heap
page read and write
640E000
stack
page read and write
3EA0000
direct allocation
page read and write
6D0000
trusted library allocation
page read and write
48B6000
trusted library allocation
page read and write
5EFD000
trusted library allocation
page read and write
5CCE000
stack
page read and write
2463000
trusted library allocation
page read and write
3E23000
direct allocation
page read and write
14F5000
heap
page read and write
48A2000
trusted library allocation
page read and write
5A2E000
stack
page read and write
403E000
direct allocation
page read and write
562C000
stack
page read and write
150D000
heap
page read and write
A90000
heap
page read and write
35B7000
trusted library allocation
page read and write
3457000
trusted library allocation
page read and write
6E2000
trusted library allocation
page read and write
77B0000
heap
page read and write
4E4C000
stack
page read and write
3FC9000
direct allocation
page read and write
4F70000
heap
page read and write
14D7000
heap
page read and write
263B000
trusted library allocation
page read and write
3577000
trusted library allocation
page read and write
14DC000
heap
page read and write
DC0000
heap
page read and write
6B0000
trusted library allocation
page read and write
3E23000
direct allocation
page read and write
150D000
heap
page read and write
6DA000
trusted library allocation
page execute and read and write
33B1000
trusted library allocation
page read and write
1CAF000
stack
page read and write
3D00000
direct allocation
page read and write
4CCD000
stack
page read and write
3EA0000
direct allocation
page read and write
2450000
trusted library allocation
page read and write
A8C000
stack
page read and write
5630000
heap
page read and write
675C000
stack
page read and write
2616000
trusted library allocation
page read and write
20AE000
stack
page read and write
48B1000
trusted library allocation
page read and write
613E000
stack
page read and write
150D000
heap
page read and write
883B000
heap
page read and write
547000
heap
page read and write
A021000
trusted library allocation
page read and write
23F5000
trusted library allocation
page read and write
4E0E000
stack
page read and write
100F000
unkown
page readonly
748000
heap
page read and write
6C0000
trusted library allocation
page read and write
14E6000
heap
page read and write
60F0000
trusted library allocation
page execute and read and write
AC0000
trusted library allocation
page read and write
53E000
stack
page read and write
710000
heap
page read and write
3597000
trusted library allocation
page read and write
2694000
trusted library allocation
page read and write
3D00000
direct allocation
page read and write
14B0000
heap
page read and write
AF0000
heap
page read and write
103F000
unkown
page read and write
CA8E000
trusted library allocation
page read and write
3E23000
direct allocation
page read and write
2549000
trusted library allocation
page read and write
48F0000
heap
page execute and read and write
24AB000
trusted library allocation
page read and write
8869000
heap
page read and write
A0C000
stack
page read and write
68B0000
trusted library allocation
page read and write
12A000
stack
page read and write
2575000
trusted library allocation
page read and write
AD0000
trusted library allocation
page read and write
1048000
unkown
page readonly
5A0000
heap
page read and write
23ED000
trusted library allocation
page read and write
3E23000
direct allocation
page read and write
3437000
trusted library allocation
page read and write
570D000
heap
page read and write
6B4000
trusted library allocation
page read and write
403E000
direct allocation
page read and write
39B4000
heap
page read and write
150E000
heap
page read and write
8E8E000
trusted library allocation
page read and write
2851000
trusted library allocation
page read and write
DA0000
heap
page read and write
3FCD000
direct allocation
page read and write
150D000
heap
page read and write
6D6000
trusted library allocation
page execute and read and write
3D00000
direct allocation
page read and write
3FC9000
direct allocation
page read and write
3477000
trusted library allocation
page read and write
157D000
heap
page read and write
3EA0000
direct allocation
page read and write
144F000
stack
page read and write
6E7000
trusted library allocation
page execute and read and write
3FC9000
direct allocation
page read and write
14F7000
heap
page read and write
99E000
stack
page read and write
1562000
heap
page read and write
CA89000
trusted library allocation
page read and write
5ED6000
trusted library allocation
page read and write
8874000
heap
page read and write
A030000
trusted library allocation
page read and write
34D7000
trusted library allocation
page read and write
98C000
stack
page read and write
1E0000
heap
page read and write
5EE4000
trusted library allocation
page read and write
4896000
trusted library allocation
page read and write
5EF3000
trusted library allocation
page read and write
35F7000
trusted library allocation
page read and write
403E000
direct allocation
page read and write
A4E000
stack
page read and write
3E23000
direct allocation
page read and write
150D000
heap
page read and write
1035000
unkown
page readonly
87B0000
heap
page read and write
14D4000
heap
page read and write
A06C000
trusted library allocation
page read and write
3557000
trusted library allocation
page read and write
A03F000
trusted library allocation
page read and write
43B8000
trusted library allocation
page read and write
700000
trusted library allocation
page read and write
62DC000
stack
page read and write
7D1000
heap
page read and write
5E8C000
stack
page read and write
540000
heap
page read and write
5B30000
trusted library allocation
page read and write
9CC000
stack
page read and write
3EA0000
direct allocation
page read and write
5C7F000
stack
page read and write
403E000
direct allocation
page read and write
3FCD000
direct allocation
page read and write
1F0000
heap
page read and write
3EA0000
direct allocation
page read and write
14E4000
heap
page read and write
403E000
direct allocation
page read and write
5A5000
heap
page read and write
EC0000
direct allocation
page execute and read and write
AB0000
trusted library allocation
page execute and read and write
A058000
trusted library allocation
page read and write
14F5000
heap
page read and write
A05D000
trusted library allocation
page read and write
8E86000
trusted library allocation
page read and write
6B3000
trusted library allocation
page execute and read and write
26D2000
trusted library allocation
page read and write
5640000
trusted library allocation
page read and write
5660000
trusted library allocation
page read and write
3EA0000
direct allocation
page read and write
5ED0000
trusted library allocation
page read and write
494C000
stack
page read and write
5F10000
trusted library allocation
page execute and read and write
6450000
heap
page read and write
A03A000
trusted library allocation
page read and write
F80000
unkown
page readonly
6EB000
trusted library allocation
page execute and read and write
F80000
unkown
page readonly
3D00000
direct allocation
page read and write
F30000
heap
page read and write
4F9000
stack
page read and write
950000
heap
page read and write
3547000
trusted library allocation
page read and write
159C000
heap
page read and write
F81000
unkown
page execute read
60A0000
heap
page read and write
2642000
trusted library allocation
page read and write
A01A000
trusted library allocation
page read and write
A04E000
trusted library allocation
page read and write
1035000
unkown
page readonly
A035000
trusted library allocation
page read and write
6040000
trusted library allocation
page read and write
26D6000
trusted library allocation
page read and write
3517000
trusted library allocation
page read and write
68AA000
heap
page read and write
49C0000
heap
page read and write
5D0E000
stack
page read and write
3FC9000
direct allocation
page read and write
There are 307 hidden memdumps, click here to show them.