IOC Report
DHL_VTER000105453.exe

loading gif

Files

File Path
Type
Category
Malicious
DHL_VTER000105453.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\DHL_VTER000105453.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\DHL_VTER000105453.exe
"C:\Users\user\Desktop\DHL_VTER000105453.exe"
 malicious
C:\Users\user\Desktop\DHL_VTER000105453.exe
"C:\Users\user\Desktop\DHL_VTER000105453.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
172.67.74.152
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://tempuri.org/DataSeta.xsd)Microsoft
unknown
http://ip-api.com
unknown
http://r3.o.lencr.org0
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://nl9.nlkoddos.com
unknown
http://r3.i.lencr.org/0
unknown
There are 4 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
nl9.nlkoddos.com
89.249.49.141
 malicious
api.ipify.org
172.67.74.152
ip-api.com
208.95.112.1

IPs

IP
Domain
Country
Malicious
89.249.49.141
nl9.nlkoddos.com
Russian Federation
malicious
208.95.112.1
ip-api.com
United States
172.67.74.152
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL_VTER000105453_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL_VTER000105453_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL_VTER000105453_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL_VTER000105453_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL_VTER000105453_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL_VTER000105453_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL_VTER000105453_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL_VTER000105453_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL_VTER000105453_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL_VTER000105453_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL_VTER000105453_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL_VTER000105453_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL_VTER000105453_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\DHL_VTER000105453_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2C1E000
trusted library allocation
page read and write
 malicious
2BF5000
trusted library allocation
page read and write
 malicious
252A000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
366E000
trusted library allocation
page read and write
 malicious
4F70000
trusted library section
page read and write
 malicious
2C16000
trusted library allocation
page read and write
 malicious
2491000
trusted library allocation
page read and write
 malicious
2292000
trusted library allocation
page read and write
C40000
heap
page read and write
6A4E000
stack
page read and write
2B91000
trusted library allocation
page read and write
2BCF000
trusted library allocation
page read and write
C30000
heap
page read and write
E08000
heap
page read and write
6EE41000
unkown
page execute read
1032000
trusted library allocation
page read and write
22A2000
trusted library allocation
page read and write
4FDB000
trusted library allocation
page read and write
3B91000
trusted library allocation
page read and write
5EAE000
stack
page read and write
22F0000
heap
page execute and read and write
5010000
trusted library allocation
page read and write
3491000
trusted library allocation
page read and write
4A60000
trusted library allocation
page execute and read and write
1020000
trusted library allocation
page read and write
103B000
trusted library allocation
page execute and read and write
7160000
heap
page read and write
4F45000
heap
page read and write
117E000
stack
page read and write
618000
heap
page read and write
1010000
trusted library allocation
page read and write
4BD0000
heap
page execute and read and write
66F0000
heap
page read and write
6A60000
trusted library allocation
page execute and read and write
4A52000
trusted library allocation
page read and write
2B70000
trusted library allocation
page read and write
553F000
stack
page read and write
2C10000
trusted library allocation
page read and write
626E000
stack
page read and write
2968000
trusted library allocation
page read and write
152000
unkown
page readonly
4F30000
trusted library section
page read and write
6EE40000
unkown
page readonly
ACF000
stack
page read and write
E77000
heap
page read and write
68A0000
trusted library allocation
page read and write
6333000
heap
page read and write
233E000
stack
page read and write
1070000
heap
page read and write
6AA0000
heap
page read and write
3535000
trusted library allocation
page read and write
66FE000
stack
page read and write
228D000
trusted library allocation
page execute and read and write
5600000
heap
page read and write
6270000
heap
page read and write
E96000
heap
page read and write
229A000
trusted library allocation
page execute and read and write
C60000
heap
page read and write
44CE000
stack
page read and write
2A00000
trusted library allocation
page read and write
1077000
heap
page read and write
E00000
heap
page read and write
2A10000
heap
page read and write
499D000
trusted library allocation
page read and write
6EE5F000
unkown
page readonly
3BF8000
trusted library allocation
page read and write
62BA000
heap
page read and write
557E000
stack
page read and write
4E4D000
stack
page read and write
6EE5D000
unkown
page read and write
2BDD000
trusted library allocation
page read and write
2BD9000
trusted library allocation
page read and write
4C8E000
stack
page read and write
2290000
trusted library allocation
page read and write
1030000
trusted library allocation
page read and write
662F000
stack
page read and write
49A2000
trusted library allocation
page read and write
9C9000
stack
page read and write
67FD000
stack
page read and write
2C14000
trusted library allocation
page read and write
5EED000
stack
page read and write
97FF000
stack
page read and write
C50000
heap
page read and write
44D8000
trusted library allocation
page read and write
2280000
trusted library allocation
page read and write
4BC0000
trusted library allocation
page execute and read and write
49E0000
trusted library allocation
page read and write
6907000
heap
page read and write
5030000
heap
page read and write
66FE000
heap
page read and write
55F0000
heap
page read and write
5FEE000
stack
page read and write
1035000
trusted library allocation
page execute and read and write
6EE5D000
unkown
page read and write
D7E000
stack
page read and write
4A70000
trusted library allocation
page read and write
56BE000
stack
page read and write
651000
heap
page read and write
22A7000
trusted library allocation
page execute and read and write
52B0000
heap
page execute and read and write
F3E000
unkown
page read and write
4B8C000
stack
page read and write
5002000
trusted library allocation
page read and write
6C0000
heap
page read and write
2C2E000
trusted library allocation
page read and write
2C28000
trusted library allocation
page read and write
8B0000
trusted library allocation
page read and write
22AB000
trusted library allocation
page execute and read and write
707000
heap
page read and write
4F50000
trusted library allocation
page read and write
602D000
stack
page read and write
8C0000
heap
page read and write
95FE000
stack
page read and write
612F000
stack
page read and write
4996000
trusted library allocation
page read and write
49C0000
trusted library allocation
page read and write
64E0000
trusted library allocation
page read and write
1050000
trusted library allocation
page read and write
689D000
trusted library allocation
page read and write
4FD0000
trusted library allocation
page read and write
543E000
stack
page read and write
49B0000
trusted library allocation
page read and write
7FD00000
trusted library allocation
page execute and read and write
1026000
trusted library allocation
page execute and read and write
2480000
heap
page read and write
6D7C000
stack
page read and write
2273000
trusted library allocation
page execute and read and write
69F0000
trusted library allocation
page read and write
2BC5000
trusted library allocation
page read and write
8CA000
stack
page read and write
3BB9000
trusted library allocation
page read and write
22E0000
trusted library allocation
page read and write
630C000
heap
page read and write
96FE000
stack
page read and write
70AD000
stack
page read and write
6AD0000
trusted library allocation
page execute and read and write
44D0000
trusted library allocation
page read and write
4A50000
trusted library allocation
page read and write
877000
heap
page read and write
66BE000
stack
page read and write
2C12000
trusted library allocation
page read and write
2283000
trusted library allocation
page read and write
243E000
stack
page read and write
6D2000
heap
page read and write
48A000
stack
page read and write
1037000
trusted library allocation
page execute and read and write
247C000
stack
page read and write
63AE000
stack
page read and write
1022000
trusted library allocation
page read and write
E35000
heap
page read and write
68B0000
trusted library allocation
page read and write
43E000
remote allocation
page execute and read and write
86E000
stack
page read and write
4D40000
heap
page read and write
2C38000
trusted library allocation
page read and write
683C000
stack
page read and write
E33000
heap
page read and write
94FF000
stack
page read and write
6911000
heap
page read and write
4BA0000
heap
page read and write
5144000
heap
page read and write
610000
heap
page read and write
8080000
heap
page read and write
4FFD000
trusted library allocation
page read and write
600000
heap
page read and write
4F80000
trusted library allocation
page read and write
22C0000
trusted library allocation
page read and write
6A7B000
stack
page read and write
E29000
heap
page read and write
4970000
trusted library allocation
page read and write
49D0000
trusted library allocation
page read and write
2B1F000
stack
page read and write
34E7000
trusted library allocation
page read and write
4BB0000
heap
page read and write
452D000
stack
page read and write
498E000
trusted library allocation
page read and write
2B80000
heap
page execute and read and write
49D5000
trusted library allocation
page read and write
ECC000
heap
page read and write
9CE000
stack
page read and write
567F000
stack
page read and write
56C0000
trusted library allocation
page read and write
6880000
trusted library allocation
page read and write
4F60000
trusted library allocation
page execute and read and write
6FA0000
heap
page read and write
6F6D000
stack
page read and write
22D0000
trusted library allocation
page execute and read and write
4974000
trusted library allocation
page read and write
652E000
stack
page read and write
100D000
trusted library allocation
page execute and read and write
102A000
trusted library allocation
page execute and read and write
EA8000
heap
page read and write
68EE000
stack
page read and write
101D000
trusted library allocation
page execute and read and write
68F0000
heap
page read and write
6900000
heap
page read and write
5E0000
heap
page read and write
53FC000
stack
page read and write
2B60000
trusted library allocation
page read and write
3583000
trusted library allocation
page read and write
4B90000
trusted library section
page readonly
227D000
trusted library allocation
page execute and read and write
653000
heap
page read and write
1003000
trusted library allocation
page execute and read and write
6A80000
trusted library allocation
page read and write
61E000
heap
page read and write
FFB000
stack
page read and write
C47000
heap
page read and write
716A000
heap
page read and write
4FDE000
trusted library allocation
page read and write
462C000
stack
page read and write
4A83000
heap
page read and write
52FC000
stack
page read and write
400000
remote allocation
page execute and read and write
5140000
heap
page read and write
DF0000
trusted library allocation
page read and write
1004000
trusted library allocation
page read and write
587000
stack
page read and write
688000
heap
page read and write
2C36000
trusted library allocation
page read and write
870000
heap
page read and write
150000
unkown
page readonly
FBE000
stack
page read and write
82D000
stack
page read and write
4FEE000
trusted library allocation
page read and write
F7E000
unkown
page read and write
6EE56000
unkown
page readonly
2BE1000
trusted library allocation
page read and write
1000000
trusted library allocation
page read and write
4ED0000
trusted library allocation
page read and write
4A40000
heap
page read and write
4A80000
heap
page read and write
637000
heap
page read and write
933E000
stack
page read and write
6280000
heap
page read and write
2270000
trusted library allocation
page read and write
6A00000
trusted library allocation
page read and write
6C7F000
stack
page read and write
92FE000
stack
page read and write
8070000
heap
page read and write
7F9F000
stack
page read and write
2B5C000
stack
page read and write
64D0000
heap
page read and write
4FE2000
trusted library allocation
page read and write
5DAF000
stack
page read and write
6890000
trusted library allocation
page read and write
64AD000
stack
page read and write
7D26000
trusted library allocation
page read and write
645000
heap
page read and write
62F000
heap
page read and write
2274000
trusted library allocation
page read and write
667D000
stack
page read and write
295E000
stack
page read and write
4FF6000
trusted library allocation
page read and write
69C0000
trusted library allocation
page execute and read and write
6A90000
trusted library allocation
page read and write
44E0000
trusted library allocation
page execute and read and write
4F2E000
stack
page read and write
22A0000
trusted library allocation
page read and write
4A00000
trusted library allocation
page read and write
4F40000
heap
page read and write
68A5000
trusted library allocation
page read and write
6C90000
trusted library section
page read and write
4991000
trusted library allocation
page read and write
4FF1000
trusted library allocation
page read and write
7170000
trusted library allocation
page read and write
7E0000
heap
page read and write
2B74000
trusted library allocation
page read and write
3499000
trusted library allocation
page read and write
616D000
stack
page read and write
2296000
trusted library allocation
page execute and read and write
497B000
trusted library allocation
page read and write
1060000
trusted library allocation
page execute and read and write
DBE000
stack
page read and write
C65000
heap
page read and write
56E0000
trusted library allocation
page read and write
69E0000
trusted library allocation
page execute and read and write
There are 268 hidden memdumps, click here to show them.