IOC Report
PO#50124.exe

loading gif

Files

File Path
Type
Category
Malicious
PO#50124.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO#50124.exe.log
CSV text
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\PO#50124.exe
"C:\Users\user\Desktop\PO#50124.exe"
 malicious
C:\Users\user\Desktop\PO#50124.exe
"C:\Users\user\Desktop\PO#50124.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.13.205
http://mail.alkuwaiti.com
unknown
http://r3.o.lencr.org0
unknown
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://r3.i.lencr.org/0
unknown

Domains

Name
IP
Malicious
mail.alkuwaiti.com
50.87.219.149
 malicious
api.ipify.org
104.26.13.205

IPs

IP
Domain
Country
Malicious
50.87.219.149
mail.alkuwaiti.com
United States
malicious
104.26.13.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#50124_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#50124_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#50124_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#50124_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#50124_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#50124_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#50124_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#50124_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#50124_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#50124_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#50124_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#50124_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#50124_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\PO#50124_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3FC3000
trusted library allocation
page read and write
 malicious
2CF1000
trusted library allocation
page read and write
 malicious
2D1C000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
10E4000
trusted library allocation
page read and write
FBE000
heap
page read and write
54C2000
trusted library allocation
page read and write
664E000
stack
page read and write
54E0000
trusted library allocation
page read and write
2CDF000
trusted library allocation
page read and write
2D24000
trusted library allocation
page read and write
6EDF0000
unkown
page readonly
1274000
heap
page read and write
5B4D000
trusted library allocation
page read and write
54D0000
trusted library allocation
page read and write
14E5000
trusted library allocation
page read and write
66D1000
heap
page read and write
2E4F000
stack
page read and write
1320000
heap
page read and write
ED0000
heap
page read and write
7757000
heap
page read and write
12E0000
trusted library allocation
page read and write
5B38000
trusted library allocation
page read and write
10B3000
trusted library allocation
page execute and read and write
2C00000
trusted library allocation
page read and write
2F51000
trusted library allocation
page read and write
3F59000
trusted library allocation
page read and write
58EF000
stack
page read and write
A1AE000
stack
page read and write
10B4000
trusted library allocation
page read and write
1106000
trusted library allocation
page execute and read and write
5890000
heap
page read and write
54F0000
trusted library allocation
page read and write
1300000
trusted library allocation
page read and write
2D1A000
trusted library allocation
page read and write
59B0000
heap
page read and write
7540000
trusted library allocation
page read and write
5BF0000
trusted library allocation
page execute and read and write
10FB000
trusted library allocation
page execute and read and write
7530000
trusted library allocation
page read and write
10F0000
trusted library allocation
page read and write
10C5000
heap
page read and write
115E000
stack
page read and write
1310000
trusted library allocation
page read and write
6EE0F000
unkown
page readonly
68CE000
stack
page read and write
100E000
stack
page read and write
FBC000
heap
page read and write
549B000
trusted library allocation
page read and write
688E000
stack
page read and write
1279000
heap
page read and write
7F0C0000
trusted library allocation
page execute and read and write
7F350000
trusted library allocation
page execute and read and write
10DD000
trusted library allocation
page execute and read and write
5B30000
trusted library allocation
page read and write
5B57000
trusted library allocation
page read and write
3F82000
trusted library allocation
page read and write
9F2D000
stack
page read and write
12DC000
stack
page read and write
F99000
heap
page read and write
8B2E000
stack
page read and write
1130000
trusted library allocation
page read and write
630E000
stack
page read and write
A42000
unkown
page readonly
666F000
heap
page read and write
68F0000
trusted library allocation
page execute and read and write
69D0000
trusted library allocation
page execute and read and write
11E1000
heap
page read and write
3060000
trusted library allocation
page read and write
54BD000
trusted library allocation
page read and write
5660000
heap
page execute and read and write
5610000
trusted library allocation
page read and write
30AC000
trusted library allocation
page read and write
1580000
trusted library allocation
page read and write
54B1000
trusted library allocation
page read and write
9E2E000
stack
page read and write
678E000
stack
page read and write
D50000
heap
page read and write
1100000
trusted library allocation
page read and write
10ED000
trusted library allocation
page execute and read and write
3D0A000
trusted library allocation
page read and write
5510000
heap
page read and write
640E000
stack
page read and write
10E2000
trusted library allocation
page read and write
69E7000
trusted library allocation
page read and write
E70000
heap
page read and write
5514000
heap
page read and write
CF8000
stack
page read and write
2C7C000
stack
page read and write
11A0000
heap
page read and write
5490000
trusted library allocation
page read and write
5B50000
trusted library allocation
page read and write
7745000
heap
page read and write
5AAD000
stack
page read and write
7690000
trusted library allocation
page execute and read and write
12F0000
trusted library allocation
page read and write
10F7000
trusted library allocation
page execute and read and write
110A000
trusted library allocation
page execute and read and write
3F51000
trusted library allocation
page read and write
766D000
stack
page read and write
10F5000
trusted library allocation
page execute and read and write
6D60000
trusted library allocation
page read and write
5663000
heap
page execute and read and write
5190000
heap
page read and write
54B6000
trusted library allocation
page read and write
2C90000
heap
page execute and read and write
68E0000
trusted library allocation
page read and write
5BDE000
stack
page read and write
2D16000
trusted library allocation
page read and write
5180000
heap
page read and write
7712000
heap
page read and write
AE6000
unkown
page readonly
BF0000
heap
page read and write
A2AE000
stack
page read and write
5680000
trusted library allocation
page execute and read and write
10F2000
trusted library allocation
page read and write
1060000
heap
page read and write
B7A000
stack
page read and write
119C000
stack
page read and write
68D0000
heap
page read and write
7751000
heap
page read and write
10D9000
trusted library allocation
page read and write
9D2E000
stack
page read and write
5580000
heap
page read and write
10D0000
trusted library allocation
page read and write
76D0000
heap
page read and write
3CC9000
trusted library allocation
page read and write
548E000
stack
page read and write
10E0000
trusted library allocation
page read and write
56A0000
trusted library allocation
page execute and read and write
47FD000
trusted library allocation
page read and write
139E000
stack
page read and write
55A0000
heap
page execute and read and write
10BD000
trusted library allocation
page execute and read and write
2CA1000
trusted library allocation
page read and write
11D4000
heap
page read and write
2E50000
heap
page execute and read and write
66DB000
heap
page read and write
5B40000
trusted library allocation
page read and write
6D90000
heap
page read and write
5670000
heap
page read and write
557E000
stack
page read and write
6EDF1000
unkown
page execute read
15A7000
heap
page read and write
D00000
heap
page read and write
2C21000
trusted library allocation
page read and write
753A000
trusted library allocation
page read and write
2F40000
heap
page read and write
2F30000
trusted library allocation
page read and write
1269000
heap
page read and write
504C000
stack
page read and write
537C000
stack
page read and write
11DF000
heap
page read and write
13A0000
trusted library allocation
page execute and read and write
6EE0D000
unkown
page read and write
69E0000
trusted library allocation
page read and write
56AE000
stack
page read and write
122F000
heap
page read and write
5690000
trusted library allocation
page read and write
F07000
heap
page read and write
1117000
trusted library allocation
page execute and read and write
104E000
stack
page read and write
53B0000
heap
page read and write
1150000
heap
page read and write
ED7000
heap
page read and write
99A000
stack
page read and write
30AE000
trusted library allocation
page read and write
5860000
trusted library allocation
page read and write
1112000
trusted library allocation
page read and write
2F20000
heap
page read and write
2D18000
trusted library allocation
page read and write
56F0000
heap
page read and write
156E000
stack
page read and write
15A0000
heap
page read and write
5640000
trusted library section
page readonly
66F5000
heap
page read and write
2FBD000
trusted library allocation
page read and write
3CA1000
trusted library allocation
page read and write
2C2D000
trusted library allocation
page read and write
53B3000
heap
page read and write
3F5D000
trusted library allocation
page read and write
305E000
trusted library allocation
page read and write
F4B000
heap
page read and write
A40000
unkown
page readonly
57AF000
stack
page read and write
1110000
trusted library allocation
page read and write
4E3E000
stack
page read and write
A16E000
stack
page read and write
1110000
trusted library allocation
page read and write
5AAE000
heap
page read and write
10EA000
trusted library allocation
page execute and read and write
2CD6000
trusted library allocation
page read and write
9F30000
heap
page read and write
129E000
stack
page read and write
5AED000
stack
page read and write
EF7000
stack
page read and write
10E6000
trusted library allocation
page execute and read and write
11C6000
heap
page read and write
2C0B000
trusted library allocation
page read and write
654E000
stack
page read and write
135A000
heap
page read and write
5494000
trusted library allocation
page read and write
730E000
stack
page read and write
76F0000
heap
page read and write
6721000
heap
page read and write
152E000
stack
page read and write
47AF000
trusted library allocation
page read and write
10B0000
trusted library allocation
page read and write
111B000
trusted library allocation
page execute and read and write
10C0000
heap
page read and write
5620000
trusted library allocation
page read and write
698E000
stack
page read and write
1263000
heap
page read and write
6699000
heap
page read and write
2D32000
trusted library allocation
page read and write
5C00000
heap
page execute and read and write
2C1E000
trusted library allocation
page read and write
54C0000
trusted library allocation
page read and write
6F10000
heap
page read and write
59A0000
heap
page read and write
A06E000
stack
page read and write
6D50000
trusted library allocation
page read and write
8C2F000
stack
page read and write
10F0000
trusted library allocation
page read and write
720E000
stack
page read and write
54F5000
trusted library allocation
page read and write
D55000
heap
page read and write
11AE000
heap
page read and write
1140000
trusted library allocation
page execute and read and write
5650000
heap
page read and write
5BE0000
trusted library section
page read and write
BE0000
heap
page read and write
2C12000
trusted library allocation
page read and write
2C1A000
trusted library allocation
page read and write
553E000
stack
page read and write
2C26000
trusted library allocation
page read and write
56EC000
stack
page read and write
2C0E000
trusted library allocation
page read and write
762E000
stack
page read and write
1350000
heap
page read and write
5895000
heap
page read and write
6EE0D000
unkown
page read and write
10D0000
trusted library allocation
page read and write
EFA000
heap
page read and write
4CA8000
trusted library allocation
page read and write
484B000
trusted library allocation
page read and write
13B0000
trusted library allocation
page read and write
5AA0000
heap
page read and write
6EE06000
unkown
page readonly
2CED000
trusted library allocation
page read and write
10A0000
trusted library allocation
page read and write
1115000
trusted library allocation
page execute and read and write
5880000
trusted library section
page read and write
1357000
heap
page read and write
5500000
trusted library allocation
page read and write
5840000
trusted library section
page read and write
6650000
heap
page read and write
400000
remote allocation
page execute and read and write
4936000
trusted library allocation
page read and write
599E000
stack
page read and write
650E000
stack
page read and write
54AE000
trusted library allocation
page read and write
57EE000
stack
page read and write
AC66000
trusted library allocation
page read and write
31D6000
trusted library allocation
page read and write
13C0000
heap
page read and write
14CF000
stack
page read and write
5864000
trusted library allocation
page read and write
2E9E000
stack
page read and write
1102000
trusted library allocation
page read and write
B090000
trusted library section
page read and write
10E3000
trusted library allocation
page execute and read and write
2BFE000
stack
page read and write
10E0000
trusted library allocation
page read and write
5C10000
trusted library allocation
page read and write
6DA0000
trusted library allocation
page execute and read and write
5B2E000
stack
page read and write
14E0000
trusted library allocation
page read and write
EA0000
heap
page read and write
10FD000
trusted library allocation
page execute and read and write
F05000
heap
page read and write
There are 271 hidden memdumps, click here to show them.