IOC Report
Order_002376662-579588_Date 24082022.exe

loading gif

Files

File Path
Type
Category
Malicious
Order_002376662-579588_Date 24082022.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
malicious
C:\Users\user\AppData\Local\Temp\nsb3C99.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
modified
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Forhaanet.Nab
ASCII text, with very long lines, with no line terminators
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy\Dgnrytmers\GPUPowerSavingConfigEditor.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Holograph\Towy\Dgnrytmers\face-cool.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Kalligraferendes\Quantisers\Aqua_20.bmp
JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=3], baseline, precision 8, 110x110, frames 3
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Noneffervescently.Cre
data
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Sigtelinjens\Tvtningerne\Tilegnelserne\Suppegrydernes79\iso_3166-1.json
UTF-8 Unicode text
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe
"C:\Users\user\Desktop\Order_002376662-579588_Date 24082022.exe"
malicious

URLs

Name
IP
Malicious
http://crl.certum.pl/ctnca2.crl0l
unknown
http://repository.certum.pl/ctnca2.cer09
unknown
http://crl.certum.pl/ctsca2021.crl0o
unknown
http://nsis.sf.net/NSIS_Error
unknown
http://repository.certum.pl/ctnca.cer09
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown
http://repository.certum.pl/ctsca2021.cer0
unknown
http://crl.certum.pl/ctnca.crl0k
unknown
http://subca.ocsp-certum.com05
unknown
http://www.certum.pl/CPS0
unknown
http://subca.ocsp-certum.com02
unknown
http://subca.ocsp-certum.com01
unknown
There are 2 hidden URLs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Platooned\Ananthropism
Swithen
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Trakeotomis
Brndboringen
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Fallalishly
Navigationsskoler
HKEY_CURRENT_USER\Software\Outsnores\Begre\Bonusernes\Skovdistrikts
Chold146

Memdumps

Base Address
Regiontype
Protect
Malicious
30C0000
direct allocation
page execute and read and write
malicious
7717B77000
stack
page read and write
1E962030000
heap
page read and write
13FFFA29000
heap
page read and write
7F8000
heap
page read and write
14000102000
heap
page read and write
24D2FB00000
heap
page read and write
7F2000
heap
page read and write
13FFF9F0000
trusted library allocation
page read and write
401000
unkown
page execute read
24D2FA53000
heap
page read and write
14004F02000
heap
page read and write
C6CE7A000
stack
page read and write
78E000
stack
page read and write
7F5000
heap
page read and write
400000
unkown
page readonly
1883A452000
heap
page read and write
14000118000
heap
page read and write
1883A44B000
heap
page read and write
14000015000
heap
page read and write
702E27F000
stack
page read and write
13FFFA13000
heap
page read and write
22F88254000
heap
page read and write
277A000
trusted library allocation
page read and write
702E577000
stack
page read and write
1883A421000
heap
page read and write
2424000
heap
page read and write
24D2F900000
heap
page read and write
401000
unkown
page execute read
13FFFA79000
heap
page read and write
13FFF9C0000
heap
page read and write
14004E3D000
heap
page read and write
13FFFAA1000
heap
page read and write
14004EB7000
heap
page read and write
40A000
unkown
page write copy
239F000
stack
page read and write
1B8AEF9000
stack
page read and write
14005024000
trusted library allocation
page read and write
1883A44D000
heap
page read and write
24D2FA29000
heap
page read and write
1883A488000
heap
page read and write
14004DC0000
trusted library allocation
page read and write
C6D07F000
stack
page read and write
1883A43C000
heap
page read and write
24D2FA4B000
heap
page read and write
690127D000
stack
page read and write
C6CCF9000
stack
page read and write
14000BF1000
trusted library allocation
page read and write
24D2FB08000
heap
page read and write
690117F000
stack
page read and write
14004DF0000
trusted library allocation
page read and write
13FFFAB3000
heap
page read and write
69009DB000
stack
page read and write
24D2FB02000
heap
page read and write
14005004000
trusted library allocation
page read and write
24D2FA82000
heap
page read and write
14004DD0000
trusted library allocation
page read and write
2420000
heap
page read and write
C6C4F7000
stack
page read and write
1883A44C000
heap
page read and write
43C000
unkown
page readonly
1E962052000
heap
page read and write
14004E00000
heap
page read and write
1E96201F000
heap
page read and write
13FFF950000
heap
page read and write
1E961F10000
heap
page read and write
1883A467000
heap
page read and write
14004EAD000
heap
page read and write
13FFFAFE000
heap
page read and write
14004EFB000
heap
page read and write
C6CB7F000
stack
page read and write
702DFBD000
stack
page read and write
13FFFFD0000
trusted library section
page read and write
1883A508000
heap
page read and write
22F87FF0000
heap
page read and write
1883A449000
heap
page read and write
1E961F60000
heap
page read and write
13FFFA72000
heap
page read and write
771787F000
stack
page read and write
24D2FA52000
heap
page read and write
14004C30000
trusted library allocation
page read and write
1883A2F0000
heap
page read and write
24D2FA70000
heap
page read and write
1E962029000
heap
page read and write
3040000
trusted library allocation
page read and write
22F88202000
heap
page read and write
99000
stack
page read and write
14005090000
trusted library allocation
page read and write
1B8ADFE000
stack
page read and write
13FFFB26000
heap
page read and write
13FFF960000
heap
page read and write
24D2FA25000
heap
page read and write
13FFFA00000
heap
page read and write
24D2F970000
heap
page read and write
14004F00000
heap
page read and write
408000
unkown
page readonly
240D000
stack
page read and write
1B8AFFF000
stack
page read and write
14004DC0000
trusted library allocation
page read and write
426000
unkown
page read and write
1883A429000
heap
page read and write
1883A463000
heap
page read and write
14004EAA000
heap
page read and write
14005000000
trusted library allocation
page read and write
14004E4A000
heap
page read and write
14000000000
heap
page read and write
14000860000
trusted library section
page readonly
1883A3F0000
trusted library allocation
page read and write
14004E62000
heap
page read and write
1883A413000
heap
page read and write
7DF000
heap
page read and write
14004CA0000
trusted library allocation
page read and write
14004F06000
heap
page read and write
702DF3C000
stack
page read and write
1E961F00000
heap
page read and write
1883A465000
heap
page read and write
808000
heap
page read and write
1883A448000
heap
page read and write
2290000
heap
page read and write
22F88190000
remote allocation
page read and write
14000770000
trusted library allocation
page read and write
14000890000
trusted library section
page readonly
1883A280000
heap
page read and write
36BB000
stack
page read and write
C6C0AB000
stack
page read and write
22F88190000
remote allocation
page read and write
C6CBFE000
stack
page read and write
69010FD000
stack
page read and write
24D2FA4D000
heap
page read and write
1883A502000
heap
page read and write
22F88220000
heap
page read and write
1883A450000
heap
page read and write
14004DD0000
trusted library allocation
page read and write
22F8823D000
heap
page read and write
1883A500000
heap
page read and write
1E962027000
heap
page read and write
22F88200000
heap
page read and write
1883A476000
heap
page read and write
C6C6FA000
stack
page read and write
14005000000
trusted library allocation
page read and write
24D2FB13000
heap
page read and write
771797B000
stack
page read and write
6900E7E000
stack
page read and write
24D2FA4A000
heap
page read and write
C6CD7E000
stack
page read and write
5D0000
heap
page read and write
C6CAFF000
stack
page read and write
14000C13000
trusted library allocation
page read and write
6900EFC000
stack
page read and write
560000
trusted library allocation
page read and write
1B8B0FE000
stack
page read and write
43A000
unkown
page read and write
10000000
unkown
page readonly
14005120000
remote allocation
page read and write
22F88160000
trusted library allocation
page read and write
1B8A9FB000
stack
page read and write
14005021000
trusted library allocation
page read and write
24D2FA3C000
heap
page read and write
13FFFB02000
heap
page read and write
14004EA2000
heap
page read and write
22F88213000
heap
page read and write
24D2FA77000
heap
page read and write
140050E0000
trusted library allocation
page read and write
C6CA7F000
stack
page read and write
1883A513000
heap
page read and write
1883A46A000
heap
page read and write
13FFFB13000
heap
page read and write
10005000
unkown
page readonly
14000100000
heap
page read and write
14005120000
remote allocation
page read and write
14005008000
trusted library allocation
page read and write
7717C7E000
stack
page read and write
24D2FA4C000
heap
page read and write
14004EEE000
heap
page read and write
22F88000000
heap
page read and write
13FFFA94000
heap
page read and write
1883A481000
heap
page read and write
140050D0000
trusted library allocation
page read and write
14000113000
heap
page read and write
1E962002000
heap
page read and write
C6C9FF000
stack
page read and write
43C000
unkown
page readonly
77173BB000
stack
page read and write
14000870000
trusted library section
page readonly
30000
heap
page read and write
14004EA0000
heap
page read and write
702E77F000
stack
page read and write
13FFFA8D000
heap
page read and write
19A000
stack
page read and write
C6C7FF000
stack
page read and write
1883A44F000
heap
page read and write
24D2FA00000
heap
page read and write
10003000
unkown
page readonly
13FFFA3D000
heap
page read and write
24D2F9A0000
trusted library allocation
page read and write
14004C20000
trusted library allocation
page read and write
1883A426000
heap
page read and write
14005120000
remote allocation
page read and write
1E962045000
heap
page read and write
13FFFA9D000
heap
page read and write
7717D7E000
stack
page read and write
1E962102000
heap
page read and write
24D2FA49000
heap
page read and write
13FFFA77000
heap
page read and write
140008A0000
trusted library section
page readonly
1E96203C000
heap
page read and write
422000
unkown
page read and write
24D2F910000
heap
page read and write
1400500E000
trusted library allocation
page read and write
702E47B000
stack
page read and write
77176FD000
stack
page read and write
13FFFA26000
heap
page read and write
24D2FA13000
heap
page read and write
1E962A02000
trusted library allocation
page read and write
14000C10000
trusted library allocation
page read and write
1883AC02000
trusted library allocation
page read and write
14004E1D000
heap
page read and write
7DA000
heap
page read and write
1883A400000
heap
page read and write
14000002000
heap
page read and write
1883A290000
heap
page read and write
C6C5FB000
stack
page read and write
400000
unkown
page readonly
73E000
stack
page read and write
24D2FA4F000
heap
page read and write
771767E000
stack
page read and write
702E67F000
stack
page read and write
5E0000
heap
page read and write
7717A7F000
stack
page read and write
7A0000
heap
page read and write
22F88229000
heap
page read and write
24D30402000
trusted library allocation
page read and write
14000880000
trusted library section
page readonly
1883A48E000
heap
page read and write
13FFFA7C000
heap
page read and write
22F8825C000
heap
page read and write
14005100000
trusted library allocation
page read and write
42A000
unkown
page read and write
7A7000
heap
page read and write
14004E12000
heap
page read and write
14000850000
trusted library section
page readonly
1E962000000
heap
page read and write
22F88302000
heap
page read and write
C6C8FB000
stack
page read and write
14000118000
heap
page read and write
14004F03000
heap
page read and write
408000
unkown
page readonly
13FFFA58000
heap
page read and write
1E962013000
heap
page read and write
1883A46B000
heap
page read and write
14004E2B000
heap
page read and write
1E961F90000
trusted library allocation
page read and write
69012FC000
stack
page read and write
24D2FA50000
heap
page read and write
40A000
unkown
page read and write
23C0000
trusted library allocation
page read and write
140050F0000
trusted library allocation
page read and write
22F88060000
heap
page read and write
14004DF0000
trusted library allocation
page read and write
10001000
unkown
page execute read
14000C20000
trusted library allocation
page read and write
7E3000
heap
page read and write
14004E55000
heap
page read and write
223F000
stack
page read and write
22F88190000
remote allocation
page read and write
13FFFA8F000
heap
page read and write
22F88A02000
trusted library allocation
page read and write
14006000000
heap
page read and write
14004EF3000
heap
page read and write
14004CB0000
trusted library allocation
page read and write
There are 260 hidden memdumps, click here to show them.