IOC Report
Order_002376662-579588_Date 24082022.exe

loading gif

Files

File Path
Type
Category
Malicious
Order_002376662-579588_Date 24082022.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
malicious
C:\Users\user\AppData\Local\Temp\nsb3C99.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
modified
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Forhaanet.Nab
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy\Dgnrytmers\GPUPowerSavingConfigEditor.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy\Dgnrytmers\face-cool.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Kalligraferendes\Quantisers\Aqua_20.bmp
JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 110x110, frames 3
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Noneffervescently.Cre
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Tilegnelserne\Suppegrydernes79\iso_3166-1.json
UTF-8 Unicode text
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe
"C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe"
malicious

URLs

Name
IP
Malicious
http://crl.certum.pl/ctnca2.crl0l
unknown
http://repository.certum.pl/ctnca2.cer09
unknown
http://crl.certum.pl/ctsca2021.crl0o
unknown
http://nsis.sf.net/NSIS_Error
unknown
http://repository.certum.pl/ctnca.cer09
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown
http://repository.certum.pl/ctsca2021.cer0
unknown
http://crl.certum.pl/ctnca.crl0k
unknown
http://subca.ocsp-certum.com05
unknown
http://www.certum.pl/CPS0
unknown
http://subca.ocsp-certum.com02
unknown
http://subca.ocsp-certum.com01
unknown
There are 2 hidden URLs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Platooned\Ananthropism
Swithen
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Trakeotomis
Brndboringen
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fallalishly
Navigationsskoler
HKEY_CURRENT_USER\Software\Outsnores\Begre\Bonusernes\Skovdistrikts
Chold146

Memdumps

Base Address
Regiontype
Protect
Malicious
30C0000
direct allocation
page execute and read and write
malicious
7717B77000
stack
page read and write
1E962030000
heap
page read and write
13FFFA29000
heap
page read and write
7F8000
heap
page read and write
14000102000
heap
page read and write
24D2FB00000
heap
page read and write
7F2000
heap
page read and write
13FFF9F0000
trusted library allocation
page read and write
401000
unkown
page execute read
24D2FA53000
heap
page read and write
14004F02000
heap
page read and write
C6CE7A000
stack
page read and write
78E000
stack
page read and write
7F5000
heap
page read and write
400000
unkown
page readonly
1883A452000
heap
page read and write
14000118000
heap
page read and write
1883A44B000
heap
page read and write
14000015000
heap
page read and write
702E27F000
stack
page read and write
13FFFA13000
heap
page read and write
22F88254000
heap
page read and write
277A000
trusted library allocation
page read and write
702E577000
stack
page read and write
1883A421000
heap
page read and write
2424000
heap
page read and write
24D2F900000
heap
page read and write
401000
unkown
page execute read
13FFFA79000
heap
page read and write
13FFF9C0000
heap
page read and write
14004E3D000
heap
page read and write
13FFFAA1000
heap
page read and write
14004EB7000
heap
page read and write
40A000
unkown
page write copy
239F000
stack
page read and write
1B8AEF9000
stack
page read and write
14005024000
trusted library allocation
page read and write
1883A44D000
heap
page read and write
24D2FA29000
heap
page read and write
1883A488000
heap
page read and write
14004DC0000
trusted library allocation
page read and write
C6D07F000
stack
page read and write
1883A43C000
heap
page read and write
24D2FA4B000
heap
page read and write
690127D000
stack
page read and write
C6CCF9000
stack
page read and write
14000BF1000
trusted library allocation
page read and write
24D2FB08000
heap
page read and write
690117F000
stack
page read and write
14004DF0000
trusted library allocation
page read and write
13FFFAB3000
heap
page read and write
69009DB000
stack
page read and write
24D2FB02000
heap
page read and write
14005004000
trusted library allocation
page read and write
24D2FA82000
heap
page read and write
14004DD0000
trusted library allocation
page read and write
2420000
heap
page read and write
C6C4F7000
stack
page read and write
1883A44C000
heap
page read and write
43C000
unkown
page readonly
1E962052000
heap
page read and write
14004E00000
heap
page read and write
1E96201F000
heap
page read and write
13FFF950000
heap
page read and write
1E961F10000
heap
page read and write
1883A467000
heap
page read and write
14004EAD000
heap
page read and write
13FFFAFE000
heap
page read and write
14004EFB000
heap
page read and write
C6CB7F000
stack
page read and write
702DFBD000
stack
page read and write
13FFFFD0000
trusted library section
page read and write
1883A508000
heap
page read and write
22F87FF0000
heap
page read and write