Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Purchase Confirmation 003-23 170204.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.961112371613167
Filename:	Purchase Confirmation 003-23 170204.exe
Filesize:	1116160
MD5:	baf61e5dbe33cf47ad6ddc4076a07af9
SHA1:	1fc141512c6a2a4715fd533d0adc1d8ce3c7842f
SHA256:	ea9deb59fc6309ddda6806eb4f7ce780eb54f1b0b7eca72b366bc8f110c5222a
SHA512:	2463f0c87870b5ddac391dcb88209cef983db246447fe1844c303d0d33c0eb1d3f70f9a7895b4fea00690862b268a36cfd69f19c18478d96c57afdf0fe11e59f
SSDEEP:	24576:+AHnh+eWsN3skA4RV1Hom2KXMmHa39eGsaq4QzOZIRE5:ph+ZkldoPK8Ya3QGa4Q+IY
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection	Exploitation for Privilege Escalation Access Token Manipulation
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Binary is likely a compiled AutoIt script file	System Summary
Contains functionality to log keystrokes (.Net Source)	Key, Mouse, Clipboard, Microphone and Screen Capturing
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to block mouse and keyboard input (often used to hinder debugging)	Anti Debugging
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)	Anti Debugging
Contains functionality to check if a window is minimized (may be used to check if an application is visible)	Hooking and other Techniques for Hiding and Protection	Application Window Discovery
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion	Valid Accounts
Contains functionality to launch a process as a different user	System Summary
Contains functionality to launch a program with higher privileges	HIPS / PFW / Operating System Protection Evasion	Exploitation for Privilege Escalation Access Token Manipulation
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Clipboard Data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate keystroke presses	HIPS / PFW / Operating System Protection Evasion
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Creates processes with suspicious names	Persistence and Installation Behavior
Detected potential crypto function	System Summary	Access Token Manipulation Encrypted Channel
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found evasive API chain (date check)	Malware Analysis System Evasion	Native API Access Token Manipulation
Found large amount of non-executed APIs	Malware Analysis System Evasion	Access Token Manipulation
Found potential string decryption / allocating functions	System Summary	Obfuscated Files or Information
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information	Access Token Manipulation System Shutdown/Reboot
Potential key logger detected (key state polling based)	Key, Mouse, Clipboard, Microphone and Screen Capturing
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Yara signature match	System Summary
.NET source code contains calls to encryption/decryption functions	System Summary	Disable or Modify Tools Deobfuscate/Decode Files or Information Archive Collected Data
Contains functionality for error logging	System Summary	Access Token Manipulation
Contains functionality to add an ACL to a security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to check free disk space	System Summary
Contains functionality to create a new security descriptor	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to instantiate COM classes	System Summary	Access Token Manipulation
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery System Information Discovery
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Program exit points	Malware Analysis System Evasion
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\autF49E.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\autF49E.tmp
Category:	dropped
Dump:	autF49E.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\Purchase Confirmation 003-23 170204.exe
Type:	data
Entropy:	7.919843163113897
Encrypted:	false
Ssdeep:	3072:ObfBnDfJyZV3ef+QSkflAtjtstHYw0nUbkhA6LFy0ytxMC//u4ld:45Dfgzuf5SEytJwUUbQA6gFtxU4ld
Size:	155330
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\autF4DE.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\autF4DE.tmp
Category:	dropped
Dump:	autF4DE.tmp.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\Purchase Confirmation 003-23 170204.exe
Type:	data
Entropy:	7.587192239652588
Encrypted:	false
Ssdeep:	192:C+cK50L02Jtyl2ftvwmziMVC6baopzBvq55Uz660tEXNzLrOOCyVqQE++:h750LRJtyl2ftLCghBmx60tEXBXOF02p
Size:	9918
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\teer

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\teer
Category:	dropped
Dump:	teer.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\Purchase Confirmation 003-23 170204.exe
Type:	data
Entropy:	6.731324055784085
Encrypted:	false
Ssdeep:	6144:mNQBQ/Epsk70OsGtfjOTKZkwCb+G9wR/dG:mNj/kDYNGZjRmt9M/Q
Size:	240128
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\wherefore

ASCII text, with very long lines (28720), with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\wherefore
Category:	dropped
Dump:	wherefore.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\Purchase Confirmation 003-23 170204.exe
Type:	ASCII text, with very long lines (28720), with no line terminators
Entropy:	3.597683173837778
Encrypted:	false
Ssdeep:	768:wiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNboE+I026c024vfF3if6g:wiTZ+2QoioGRk6ZklputwjpjBkCiw2Rb
Size:	28720
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\Purchase Confirmation 003-23 170204.exe

"C:\Users\user\Desktop\Purchase Confirmation 003-23 170204.exe"

Details

Is windows:	false
Is dropped:	false
PID:	868
Target ID:	0
Parent PID:	2592
Name:	Purchase Confirmation 003-23 170204.exe
Path:	C:\Users\user\Desktop\Purchase Confirmation 003-23 170204.exe
Commandline:	"C:\Users\user\Desktop\Purchase Confirmation 003-23 170204.exe"
Size:	1116160
MD5:	BAF61E5DBE33CF47AD6DDC4076A07AF9
Time:	10:07:05
Date:	26/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xa40000
Modulesize:	1142784
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Binary is likely a compiled AutoIt script file	System Summary
Initial sample is a PE file and has a suspicious name	System Summary
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\user\Desktop\Purchase Confirmation 003-23 170204.exe"

Details

Is windows:	true
Is dropped:	false
PID:	5276
Target ID:	8
Parent PID:	868
Name:	RegSvcs.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Commandline:	"C:\Users\user\Desktop\Purchase Confirmation 003-23 170204.exe"
Size:	45984
MD5:	9D352BC46709F0CB5EC974633A0C3C94
Time:	10:07:06
Date:	26/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x890000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://r3.o.lencr.org0

unknown

Details

Name:	http://r3.o.lencr.org0
TargetID:	8
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000008.00000002.2507151222.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2510640456.0000000005E30000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2507483866.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2509111644.0000000002CBE000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://account.dyn.com/

unknown

Details

Name:	https://account.dyn.com/
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\Purchase Confirmation 003-23 170204.exe
Source:	Purchase Confirmation 003-23 170204.exe, 00000000.00000002.1286015462.0000000002210000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2506684443.0000000000402000.00000040.80000000.00040000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://mail.bezelety.top

unknown

Details

Name:	http://mail.bezelety.top
TargetID:	8
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000008.00000002.2509111644.0000000002CBE000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for domain / URL	AV Detection
URLs found in memory or binary data	Networking

http://x1.c.lencr.org/0

unknown

Details

Name:	http://x1.c.lencr.org/0
TargetID:	8
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000008.00000002.2510640456.0000000005E30000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2507483866.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2509111644.0000000002CBE000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://x1.i.lencr.org/0

unknown

Details

Name:	http://x1.i.lencr.org/0
TargetID:	8
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000008.00000002.2510640456.0000000005E30000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2507483866.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2509111644.0000000002CBE000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://bezelety.top

unknown

Details

Name:	http://bezelety.top
TargetID:	8
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000008.00000002.2509111644.0000000002CBE000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for domain / URL	AV Detection
URLs found in memory or binary data	Networking

http://r3.i.lencr.org/0

unknown

Details

Name:	http://r3.i.lencr.org/0
TargetID:	8
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000008.00000002.2507151222.0000000000F48000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2510640456.0000000005E30000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2507483866.0000000000FD0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2509111644.0000000002CBE000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

mail.bezelety.top

unknown

Details

Name:	mail.bezelety.top
TargetID:	-1

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Multi AV Scanner detection for domain / URL	AV Detection
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

bezelety.top

194.36.191.196

Details

Name:	bezelety.top
IP:	194.36.191.196
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

194.36.191.196

bezelety.top

Netherlands

Details

IP:	194.36.191.196
TargetID:	8
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	60117
ASN name:	HSAE
Private:	false
Domain:	bezelety.top

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol

Memdumps

Base Address

Regiontype

Protect

Malicious

402000

system

page execute and read and write

2CE8000

trusted library allocation

page read and write

2C71000

trusted library allocation

page read and write

2210000

direct allocation

page read and write

2CBE000

trusted library allocation

page read and write

5730000

trusted library allocation

page read and write

211E000

stack

page read and write

61C7000

trusted library allocation

page read and write

10F0000

trusted library allocation

page execute and read and write

4069000

direct allocation

page read and write

2BFE000

trusted library allocation

page read and write

1552000

heap

page read and write

FF3000

heap

page read and write

F48000

heap

page read and write

2CE4000

trusted library allocation

page read and write

11EC000

stack

page read and write

3C71000

trusted library allocation

page read and write

2C33000

heap

page read and write

16D0000

heap

page read and write

2BB0000

heap

page read and write

5E30000

heap

page read and write

402D000

direct allocation

page read and write

1053000

trusted library allocation

page execute and read and write

1649000

heap

page read and write

3F00000

direct allocation

page read and write

F3A000

heap

page read and write

6070000

trusted library allocation

page read and write

13CE000

stack

page read and write

2BA0000

heap

page execute and read and write

155F000

heap

page read and write

FD0000

heap

page read and write

40DE000

direct allocation

page read and write

1087000

trusted library allocation

page execute and read and write

1007000

heap

page read and write

2C60000

heap

page read and write

2B9F000

stack

page read and write

402D000

direct allocation

page read and write

1050000

trusted library allocation

page read and write

1670000

heap

page read and write

2C30000

heap

page read and write

6BD0000

heap

page read and write

11F0000

heap

page read and write

11DB000

stack

page read and write

1D1E000

stack

page read and write

50FC000

stack

page read and write

990000

heap

page read and write

1434000

heap

page read and write

2C1D000

trusted library allocation

page read and write

570E000

stack

page read and write

F00000

trusted library allocation

page read and write

1118000

trusted library allocation

page read and write

F2E000

heap

page read and write

1100000

heap

page read and write

5180000

heap

page execute and read and write

406D000

direct allocation

page read and write

ACF000

unkown

page readonly

406D000

direct allocation

page read and write

1370000

heap

page read and write

3EC3000

direct allocation

page read and write

16B0000

heap

page read and write

B0A000

unkown

page readonly

409E000

direct allocation

page read and write

515E000

stack

page read and write

3DA0000

direct allocation

page read and write

637D000

stack

page read and write

106D000

trusted library allocation

page execute and read and write

6090000

trusted library allocation

page execute and read and write

155F000

heap

page read and write

2270000

heap

page read and write

15B3000

heap

page read and write

40DE000

direct allocation

page read and write

108B000

trusted library allocation

page execute and read and write

15B3000

heap

page read and write

F10000

heap

page read and write

15B3000

heap

page read and write

16CF000

heap

page read and write

A40000

unkown

page readonly

3E83000

direct allocation

page read and write

1380000

heap

page read and write

14E0000

direct allocation

page execute and read and write

1666000

heap

page read and write

3CD6000

trusted library allocation

page read and write

B18000

unkown

page readonly

1072000

trusted library allocation

page read and write

3F00000

direct allocation

page read and write

2CF1000

trusted library allocation

page read and write

61D0000

trusted library allocation

page read and write

3C99000

trusted library allocation

page read and write

61C0000

trusted library allocation

page read and write

1054000

trusted library allocation

page read and write

1591000

heap

page read and write

15D3000

heap

page read and write

F45000

heap

page read and write

1070000

trusted library allocation

page read and write

2C50000

trusted library allocation

page read and write

1250000

heap

page read and write

AF5000

unkown

page readonly

92A000

stack

page read and write

AF5000

unkown

page readonly

F9A000

heap

page read and write

2C0E000

trusted library allocation

page read and write

15B3000

heap

page read and write

2BD0000

trusted library allocation

page read and write

67BE000

stack

page read and write

2BE0000

trusted library allocation

page read and write

DE5000

heap

page read and write

3D60000

direct allocation

page read and write

15B3000

heap

page read and write

B0A000

unkown

page readonly

1085000

trusted library allocation

page execute and read and write

F18000

heap

page read and write

2C11000

trusted library allocation

page read and write

560D000

stack

page read and write

A41000

unkown

page execute read

A41000

unkown

page execute read

3F40000

direct allocation

page read and write

4069000

direct allocation

page read and write

10EE000

stack

page read and write

2C16000

trusted library allocation

page read and write

160D000

heap

page read and write

3D60000

direct allocation

page read and write

55CF000

stack

page read and write

15A2000

heap

page read and write

168E000

heap

page read and write

3E83000

direct allocation

page read and write

5190000

heap

page read and write

6086000

trusted library allocation

page read and write

60DD000

stack

page read and write

6940000

trusted library allocation

page execute and read and write

2C40000

trusted library allocation

page read and write

16D0000

heap

page read and write

B03000

unkown

page write copy

B18000

unkown

page readonly

5178000

trusted library allocation

page read and write

DE0000

heap

page read and write

1527000

heap

page read and write

402D000

direct allocation

page read and write

61BD000

stack

page read and write

538C000

stack

page read and write

1076000

trusted library allocation

page execute and read and write

15B4000

heap

page read and write

1430000

heap

page read and write

1060000

trusted library allocation

page read and write

15B3000

heap

page read and write

15A2000

heap

page read and write

9E0000

heap

page read and write

7F4F0000

trusted library allocation

page execute and read and write

2CD7000

trusted library allocation

page read and write

409E000

direct allocation

page read and write

400000

system

page execute and read and write

1520000

heap

page read and write

15B3000

heap

page read and write

60E0000

trusted library allocation

page execute and read and write

4029000

direct allocation

page read and write

617E000

stack

page read and write

4D6D000

stack

page read and write

3F00000

direct allocation

page read and write

105D000

trusted library allocation

page execute and read and write

AFF000

unkown

page read and write

15B2000

heap

page read and write

15A0000

heap

page read and write

5170000

trusted library allocation

page read and write

136E000

stack

page read and write

ACF000

unkown

page readonly

1590000

heap

page read and write

2BF6000

trusted library allocation

page read and write

B08000

unkown

page readonly

4029000

direct allocation

page read and write

BEA000

stack

page read and write

14C0000

heap

page read and write

1552000

heap

page read and write

16C0000

heap

page read and write

2BF0000

trusted library allocation

page read and write

2C22000

trusted library allocation

page read and write

1080000

trusted library allocation

page read and write

6080000

trusted library allocation

page read and write

15B3000

heap

page read and write

3EC3000

direct allocation

page read and write

3D60000

direct allocation

page read and write

16DF000

heap

page read and write

16A0000

heap

page read and write

3F40000

direct allocation

page read and write

6930000

heap

page read and write

3DA0000

direct allocation

page read and write

2C0A000

trusted library allocation

page read and write

11BF000

stack

page read and write

155F000

heap

page read and write

3DA0000

direct allocation

page read and write

6900000

trusted library allocation

page read and write

573C000

trusted library allocation

page read and write

54CE000

stack

page read and write

406D000

direct allocation

page read and write

66BE000

stack

page read and write

CF8000

stack

page read and write

16DD000

heap

page read and write

107A000

trusted library allocation

page execute and read and write

AFF000

unkown

page write copy

11FD000

stack

page read and write

A40000

unkown

page readonly

548F000

stack

page read and write

409E000

direct allocation

page read and write

3F40000

direct allocation

page read and write

10A0000

trusted library allocation

page read and write

2BFB000

trusted library allocation

page read and write

1543000

heap

page read and write

1082000

trusted library allocation

page read and write

4029000

direct allocation

page read and write

3E83000

direct allocation

page read and write

B08000

unkown

page readonly

16B0000

heap

page read and write

15A0000

heap

page read and write

2CBC000

trusted library allocation

page read and write

11CF000

stack

page read and write

4069000

direct allocation

page read and write

2C02000

trusted library allocation

page read and write

40DE000

direct allocation

page read and write

3EC3000

direct allocation

page read and write

There are 207 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Purchase Confirmation 003-23 170204.exe

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportPurchase Confirmation 003-23 170204.exe

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
Purchase Confirmation 003-23 170204.exe