IOC Report
RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe

loading gif

Files

File Path
Type
Category
Malicious
RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe
PE32 executable (console) Intel 80386, for MS Windows
initial sample
 malicious
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe
"C:\Users\user\Desktop\RFQ Img_Quotation PO 202400969 - HESSEN TECH_pdf.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.13.205
http://r3.o.lencr.org0
unknown
http://mail.temikan.com.tr
unknown
https://api.ipify.org
unknown
http://r3.i.lencr.org/0B
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://temikan.com.tr
unknown
http://cps.root-x1.letsencrypt.org0
unknown
There are 2 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
temikan.com.tr
31.192.214.172
 malicious
mail.temikan.com.tr
unknown
 malicious
api.ipify.org
104.26.13.205

IPs

IP
Domain
Country
Malicious
31.192.214.172
temikan.com.tr
Turkey
malicious
104.26.13.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
BCC000
unkown
page read and write
 malicious
2DA1000
trusted library allocation
page read and write
 malicious
2DCC000
trusted library allocation
page read and write
 malicious
2DD4000
trusted library allocation
page read and write
 malicious
65FD000
trusted library allocation
page read and write
BC2000
unkown
page readonly
11DA000
heap
page read and write
C07000
unkown
page execute and read and write
5206000
trusted library allocation
page read and write
FC5000
heap
page read and write
66DF000
stack
page read and write
6647000
trusted library allocation
page read and write
1112000
trusted library allocation
page read and write
7FC40000
trusted library allocation
page execute and read and write
2D51000
trusted library allocation
page read and write
570E000
stack
page read and write
1350000
trusted library allocation
page read and write
607A000
heap
page read and write
2D20000
trusted library allocation
page read and write
6AA7000
trusted library allocation
page read and write
5AB0000
trusted library allocation
page execute and read and write
BA1000
unkown
page execute read
5A4D000
stack
page read and write
10F0000
trusted library allocation
page read and write
1127000
trusted library allocation
page execute and read and write
10FD000
trusted library allocation
page execute and read and write
5340000
heap
page read and write
5AA8000
trusted library allocation
page read and write
54D0000
heap
page read and write
1150000
heap
page read and write
52EE000
stack
page read and write
580E000
stack
page read and write
10E0000
trusted library allocation
page read and write
6AB0000
trusted library allocation
page read and write
51FA000
trusted library allocation
page read and write
2DA0000
heap
page read and write
6090000
heap
page read and write
11DE000
heap
page read and write
C09000
unkown
page readonly
5212000
trusted library allocation
page read and write
2D30000
heap
page execute and read and write
1125000
trusted library allocation
page execute and read and write
51EE000
trusted library allocation
page read and write
51D0000
trusted library allocation
page read and write
6730000
trusted library allocation
page read and write
2D9D000
trusted library allocation
page read and write
528C000
stack
page read and write
607E000
heap
page read and write
51E6000
trusted library allocation
page read and write
1195000
heap
page read and write
1100000
trusted library allocation
page read and write
B90000
heap
page read and write
BA1000
unkown
page execute read
520D000
trusted library allocation
page read and write
2C78000
trusted library allocation
page read and write
13A0000
heap
page read and write
13C0000
heap
page read and write
113F000
stack
page read and write
BCC000
unkown
page write copy
51EB000
trusted library allocation
page read and write
BB9000
stack
page read and write
6720000
trusted library allocation
page execute and read and write
60C6000
heap
page read and write
1234000
heap
page read and write
51E0000
trusted library allocation
page read and write
51FE000
trusted library allocation
page read and write
110D000
trusted library allocation
page execute and read and write
590F000
stack
page read and write
1140000
heap
page read and write
1120000
trusted library allocation
page read and write
6B10000
trusted library allocation
page execute and read and write
10F4000
trusted library allocation
page read and write
122E000
heap
page read and write
DE0000
heap
page read and write
4E8D000
stack
page read and write
15CF000
stack
page read and write
65EE000
stack
page read and write
ABA000
stack
page read and write
64EE000
stack
page read and write
112B000
trusted library allocation
page execute and read and write
BA0000
unkown
page readonly
2DC6000
trusted library allocation
page read and write
D0D000
stack
page read and write
65F0000
trusted library allocation
page read and write
3D79000
trusted library allocation
page read and write
C09000
unkown
page readonly
2D40000
heap
page read and write
11EB000
heap
page read and write
1192000
heap
page read and write
11D0000
heap
page read and write
5AA0000
trusted library allocation
page read and write
1188000
heap
page read and write
3DB4000
trusted library allocation
page read and write
663D000
stack
page read and write
6B00000
heap
page read and write
611C000
heap
page read and write
2DC8000
trusted library allocation
page read and write
532E000
stack
page read and write
13C6000
heap
page read and write
5A8E000
stack
page read and write
BC2000
unkown
page readonly
1116000
trusted library allocation
page execute and read and write
1229000
heap
page read and write
560C000
stack
page read and write
5500000
heap
page execute and read and write
11F0000
heap
page read and write
6AC0000
trusted library allocation
page read and write
5201000
trusted library allocation
page read and write
6AA0000
trusted library allocation
page read and write
5350000
heap
page read and write
1110000
trusted library allocation
page read and write
2D8F000
trusted library allocation
page read and write
64AE000
stack
page read and write
6640000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
118E000
stack
page read and write
2D10000
trusted library allocation
page execute and read and write
2D86000
trusted library allocation
page read and write
51F2000
trusted library allocation
page read and write
10F3000
trusted library allocation
page execute and read and write
F00000
heap
page read and write
5220000
trusted library allocation
page read and write
E20000
heap
page read and write
2C6F000
stack
page read and write
3D51000
trusted library allocation
page read and write
6110000
heap
page read and write
5343000
heap
page read and write
6070000
heap
page read and write
63AF000
stack
page read and write
6AD0000
heap
page read and write
1140000
heap
page read and write
BA0000
unkown
page readonly
C08000
unkown
page read and write
4D8C000
stack
page read and write
548D000
stack
page read and write
5230000
trusted library allocation
page read and write
103E000
stack
page read and write
2DCA000
trusted library allocation
page read and write
B3C000
stack
page read and write
1122000
trusted library allocation
page read and write
111A000
trusted library allocation
page execute and read and write
FC0000
heap
page read and write
2DDF000
trusted library allocation
page read and write
139E000
stack
page read and write
115B000
heap
page read and write
There are 136 hidden memdumps, click here to show them.