IOC Report

loading gif

Files

File Path
Type
Category
Malicious
Statement from QNB.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
malicious
C:\Users\user\AppData\Local\Temp\~DF9449C0319C5371E6.TMP
Composite Document File V2 Document, Cannot read section info
dropped
clean

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Statement from QNB.exe
"C:\Users\user\Desktop\Statement from QNB.exe"
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
21F0000
unkown
page execute and read and write
malicious
2230000
heap private
page read and write
clean
7FF5D09A2000
unkown image
page readonly
clean
1FC3A5C0000
unkown
page read and write
clean
1FC3A840000
unkown
page read and write
clean
1FC34FF3000
unkown
page read and write
clean
48A000
heap default
page read and write
clean
7FF5D0D34000
unkown image
page readonly
clean
7FF5D0B39000
unkown image
page readonly
clean
7FF5D09C9000
unkown image
page readonly
clean
1FC3A4E8000
unkown
page read and write
clean
7FF5D0D29000
unkown image
page readonly
clean
7FF5D0BEF000
unkown image
page readonly
clean
1FC3A6D5000
unkown
page read and write
clean
5D204FA000
stack
page read and write
clean
1FC35000000
unkown
page read and write
clean
1FC3A6A1000
unkown
page read and write
clean
7FFB2000
unkown image
page readonly
clean
7FF5D0E04000
unkown image
page readonly
clean
401000
unkown image
page execute read
clean
1FC3A6F4000
unkown
page read and write
clean
7FEB0000
unkown image
page readonly
clean
1FC3A661000
unkown
page read and write
clean
1FC3A646000
unkown
page read and write
clean
7DF5DAC00000
unkown image
page readonly
clean
D52B07F000
stack
page read and write
clean
1FC36370000
unkown
page read and write
clean
7FF5D0E33000
unkown image
page readonly
clean
7FF521DF4000
unkown image
page readonly
clean
214FA010000
heap default
page read and write
clean
1FC35918000
unkown
page read and write
clean
5D203F7000
stack
page read and write
clean
7FF5D0D3F000
unkown image
page readonly
clean
214F9FF0000
unkown
page read and write
clean
1FC3A520000
unkown
page read and write
clean
214F9FE0000
unkown
page read and write
clean
1FC3A64D000
unkown
page read and write
clean
D52B0F9000
stack
page read and write
clean
5D20E7F000
stack
page read and write
clean
7FF5D0B32000
unkown image
page readonly
clean
7FF5D0B46000
unkown image
page readonly
clean
1FC3A6FB000
unkown
page read and write
clean
421000
unkown image
page readonly
clean
2410000
unkown
page read and write
clean
D80000
unkown image
page readonly
clean
7FF5D0E07000
unkown image
page readonly
clean
1FC3A700000
unkown
page read and write
clean
7FFD0000
unkown image
page readonly
clean
7FF521E37000
unkown image
page readonly
clean
7FF5D0DF7000
unkown image
page readonly
clean
214FA2E9000
heap private
page read and write
clean
5D207FA000
stack
page read and write
clean
1FC3A640000
unkown
page read and write
clean
1FC3A3C0000
unkown
page read and write
clean
1FC35200000
unkown image
page readonly
clean
7FF5D0D97000
unkown image
page readonly
clean
1FC34E60000
unkown image
page readonly
clean
7FF521D87000
unkown image
page readonly
clean
1FC3A3E0000
unkown
page read and write
clean
421000
unkown image
page readonly
clean
1FC3A6F6000
unkown
page read and write
clean
D52AFF9000
stack
page read and write
clean
1FC3A840000
unkown
page read and write
clean
7FF5D0D8D000
unkown image
page readonly
clean
7FF5D0DFD000
unkown image
page readonly
clean
1FC3A640000
unkown
page read and write
clean
7FF521DE4000
unkown image
page readonly
clean
7FF5D0D53000
unkown image
page readonly
clean
1FC34E30000
unkown image
page readonly
clean
7FF521D89000
unkown image
page readonly
clean
1FC35904000
unkown
page read and write
clean
7FF5D0D9E000
unkown image
page readonly
clean
214FA2E5000
heap private
page read and write
clean
41F000
unkown image
page read and write
clean