IOC Report
rFACTURA_FAC_2023_1-1000733.PDF.exe

loading gif

Files

File Path
Type
Category
Malicious
rFACTURA_FAC_2023_1-1000733.PDF.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\antiphthisical\Primar\Cunicular\Densimetric\Talestrmmene.Unr
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\Nikotins61.sto
ASCII text, with very long lines (22842), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\System.Reflection.TypeExtensions.dll
PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\antiphthisical\Primar\Cunicular\Densimetric\System.Reflection.Primitives.dll
PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\battery-level-90-charging-symbolic.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\colorimeter-colorhug-symbolic.symbolic.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\media-playlist-consecutive-symbolic.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\network-offline-symbolic.svg
SVG Scalable Vector Graphics image
dropped
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\network-wireless.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\preferences-desktop-font-symbolic.symbolic.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\task-due-symbolic.symbolic.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\Musicalises34\Coleman\Biarcuated\window-close.png
PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
dropped
C:\Users\user\AppData\Local\Temp\nsa150D.tmp\AdvSplash.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\nsa150D.tmp\System.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
There are 5 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\rFACTURA_FAC_2023_1-1000733.PDF.exe
C:\Users\user\Desktop\rFACTURA_FAC_2023_1-1000733.PDF.exe
 malicious

URLs

Name
IP
Malicious
http://creativecommons.org/ns#DerivativeWorks
unknown
http://crl.certum.pl/ctsca2021.crl0o
unknown
http://creativecommons.org/licenses/by-sa/4.0/
unknown
http://creativecommons.org/ns#Distribution
unknown
http://repository.certum.pl/ctnca.cer09
unknown
http://repository.certum.pl/ctsca2021.cer0
unknown
http://crl.certum.pl/ctnca.crl0k
unknown
http://subca.ocsp-certum.com05
unknown
http://creativecommons.org/ns#Attribution
unknown
http://subca.ocsp-certum.com02
unknown
http://subca.ocsp-certum.com01
unknown
http://crl.certum.pl/ctnca2.crl0l
unknown
http://repository.certum.pl/ctnca2.cer09
unknown
http://creativecommons.org/ns#ShareAlike
unknown
https://github.com/dotnet/runtimeBSJB
unknown
http://nsis.sf.net/NSIS_ErrorError
unknown
http://creativecommons.org/ns#Notice
unknown
http://creativecommons.org/ns#Reproduction
unknown
http://www.certum.pl/CPS0
unknown
http://creativecommons.org/ns#
unknown
https://github.com/dotnet/runtime
unknown
There are 11 hidden URLs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\Software\InstallDir32
Path
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Micos\Irises\Kandissens\Raceblanding
Sulphammonium164
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Hermeneutics\Ophjedes\Amtsraadsmedlemmet
Printerproblemernes
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Replyingly\Avnbgen\Spisekamrenes
Rumfartscenterets
HKEY_LOCAL_MACHINE\SOFTWARE\Fetichry
Isobase

Memdumps

Base Address
Regiontype
Protect
Malicious
59F0000
direct allocation
page execute and read and write
 malicious
4480000
direct allocation
page execute and read and write
 malicious
1E7A442E000
heap
page read and write
2CA0000
heap
page read and write
68C3AFF000
stack
page read and write
2A89AF60000
heap
page read and write
19371FA0000
trusted library allocation
page read and write
2531BA41000
heap
page read and write
3E2217F000
stack
page read and write
7AB000
unkown
page read and write
8D0000
heap
page read and write
1F66AC80000
heap
page read and write
1E7A42E0000
heap
page read and write
29AE000
stack
page read and write
2531C150000
trusted library allocation
page read and write
19371FC0000
trusted library allocation
page read and write
1DCA1833000
heap
page read and write
A5F000
heap
page read and write
FB8457B000
stack
page read and write
A54000
heap
page read and write
174A2A49000
heap
page read and write
1E7A4502000
heap
page read and write
1937122F000
heap
page read and write
19371450000
heap
page read and write
1D767613000
heap
page read and write
2A89B0C7000
heap
page read and write
5741FFC000
stack
page read and write
A8B75FF000
stack
page read and write
1937122F000
heap
page read and write
1E7A4400000
heap
page read and write
782000
unkown
page read and write
22955EE0000
heap
page read and write
1DCA1780000
trusted library allocation
page read and write
7B3000
unkown
page read and write
68C337E000
stack
page read and write
1F66ACF0000
heap
page read and write
1DCA1831000
heap
page read and write
245667C000
stack
page read and write
2CFD000
stack
page read and write
1F66AF13000
heap
page read and write
1DCA1620000
heap
page read and write
1F66AE3D000
heap
page read and write
1E7A4402000
heap
page read and write
19372020000
trusted library allocation
page read and write
2A89B912000
heap
page read and write
1DCA1902000
heap
page read and write
3E2207C000
stack
page read and write
19371D90000
trusted library allocation
page read and write
68C397F000
stack
page read and write
1D767679000
heap
page read and write
22956670000
remote allocation
page read and write
1F66B722000
heap
page read and write
408000
unkown
page readonly
2424000
heap
page read and write
57421FD000
stack
page read and write
1DCA1829000
heap
page read and write
1F66B823000
heap
page read and write
1DCA183A000
heap
page read and write
2A89B06B000
heap
page read and write
A8B717E000
stack
page read and write
1DCA1845000
heap
page read and write
174A2A59000
heap
page read and write
2531B990000
heap
page read and write
1F66AE00000
heap
page read and write
1D7675E0000
trusted library allocation
page read and write
FB843FC000
stack
page read and write
2531BB13000
heap
page read and write
2456B7F000
stack
page read and write
2AAF000
stack
page read and write
1F66B790000
heap
page read and write
9D0000
heap
page read and write
400000
unkown
page readonly
1DCA1874000
heap
page read and write
1E7A443C000
heap
page read and write
1DCA1857000
heap
page read and write
7E0000
unkown
page readonly
1F66B754000
heap
page read and write
1D767602000
heap
page read and write
1D767628000
heap
page read and write
3E2237E000
stack
page read and write
1DCA1862000
heap
page read and write
174A43A0000
trusted library allocation
page read and write
174A2980000
trusted library allocation
page read and write
1F66B800000
heap
page read and write
2A89B113000
heap
page read and write
2531BA00000
heap
page read and write
FB8427F000
stack
page read and write
40A000
unkown
page read and write
A8B72FE000
stack
page read and write
1F66B470000
trusted library allocation
page read and write
174A2A00000
heap
page read and write
174A29F0000
remote allocation
page read and write
19371060000
trusted library allocation
page read and write
1F66B7BA000
heap
page read and write
1DCA1848000
heap
page read and write
1DCA1858000
heap
page read and write
296F000
stack
page read and write
1F66AE64000
heap
page read and write
174A2A4A000
heap
page read and write
1F66AE2F000
heap
page read and write
1DCA1840000
heap
page read and write
57423FF000
stack
page read and write
1DCA184E000
heap
page read and write
68C3679000
stack
page read and write
1DCA1861000
heap
page read and write
3E21E7B000
stack
page read and write
1F66B830000
heap
page read and write
1DCA186D000
heap
page read and write
7E9000
unkown
page readonly
1F66AFE5000
heap
page read and write
174A2B13000
heap
page read and write
1D767700000
heap
page read and write
2531BA75000
heap
page read and write
FB8437E000
stack
page read and write
1DCA186F000
heap
page read and write
1D7673A0000
heap
page read and write
A3D000
heap
page read and write
1F66AE85000
heap
page read and write
2A89B0B9000
heap
page read and write
1DCA1875000
heap
page read and write
FB844FD000
stack
page read and write
FB8477E000
stack
page read and write
7A4000
unkown
page read and write
3E225FC000
stack
page read and write
68C377F000
stack
page read and write
2456979000
stack
page read and write
68C35FC000
stack
page read and write
22956670000
remote allocation
page read and write
19A000
stack
page read and write
1F66B7C8000
heap
page read and write
2531BA02000
heap
page read and write
2A89B086000
heap
page read and write
174A2A02000
heap
page read and write
1F66B702000
heap
page read and write
1DCA1879000
heap
page read and write
1DCA185F000
heap
page read and write
2A89B029000
heap
page read and write
1F66AE43000
heap
page read and write
1F66ADF0000
trusted library allocation
page read and write
31B0000
trusted library allocation
page read and write
2420000
heap
page read and write
7E0000
unkown
page readonly
6D5C32B000
stack
page read and write
1D767668000
heap
page read and write
2A89B065000
heap
page read and write
174A2A13000
heap
page read and write
2A89B0CA000
heap
page read and write
7D0000
unkown
page readonly
57424FF000
stack
page read and write
E47E96B000
stack
page read and write
A70000
heap
page read and write
22956670000
remote allocation
page read and write
1DCA1883000
heap
page read and write
789000
unkown
page read and write
1DCA1842000
heap
page read and write
408000
unkown
page readonly
77C000
unkown
page read and write
22955E80000
heap
page read and write
3E2227E000
stack
page read and write
22956802000
trusted library allocation
page read and write
10005000
unkown
page readonly
22956057000
heap
page read and write
1E7A4443000
heap
page read and write
57419EB000
stack
page read and write
1DCA187E000
heap
page read and write
1D09979000
stack
page read and write
1E7A4413000
heap
page read and write
22956002000
heap
page read and write
19371227000
heap
page read and write
2AB0000
heap
page read and write
2531BB02000
heap
page read and write
68C387A000
stack
page read and write
2A89AEF0000
heap
page read and write
1F66AE8B000
heap
page read and write
1E7A444C000
heap
page read and write
6D5C87B000
stack
page read and write
E47F0FE000
stack
page read and write
174A2B02000
heap
page read and write
1D767600000
heap
page read and write
40A000
unkown
page write copy
1DCA1813000
heap
page read and write
FB83C8B000
stack
page read and write
1D767663000
heap
page read and write
1E7A4370000
trusted library allocation
page read and write
193711F0000
heap
page read and write
1DCA187A000
heap
page read and write
22956013000
heap
page read and write
6D5CB7E000
stack
page read and write
1DCA2002000
trusted library allocation
page read and write
FB8487C000
stack
page read and write
A17000
heap
page read and write
1D767656000
heap
page read and write
1F66AE54000
heap
page read and write
174A29F0000
remote allocation
page read and write
2A89B013000
heap
page read and write
1DCA1846000
heap
page read and write
2531BA3E000
heap
page read and write
1D0967B000
stack
page read and write
2A89B0E1000
heap
page read and write
1F66AE6F000
heap
page read and write
1D767702000
heap
page read and write
A51000
heap
page read and write
1F66AE51000
heap
page read and write
1F66AF8E000
heap
page read and write
174A2A5A000
heap
page read and write
A8B74FF000
stack
page read and write
1F66B827000
heap
page read and write
A56000
heap
page read and write
2A89B900000
heap
page read and write
1E7A4340000
heap
page read and write
1D767713000
heap
page read and write
1DCA186C000
heap
page read and write
2A89B102000
heap
page read and write
174A2960000
trusted library allocation
page read and write
2CB0000
heap
page read and write
4FF0000
direct allocation
page execute and read and write
1D767640000
heap
page read and write
174A2800000
heap
page read and write
19371400000
trusted library allocation
page read and write
22955E70000
heap
page read and write
2DFD000
stack
page read and write
22956023000
heap
page read and write
7E9000
unkown
page readonly
10003000
unkown
page readonly
174A2A5A000
heap
page read and write
1F66B722000
heap
page read and write
401000
unkown
page execute read
174A29B0000
trusted library allocation
page read and write
A49000
heap
page read and write
7A6000
unkown
page read and write
68C2FFC000
stack
page read and write
19371410000
trusted library allocation
page read and write
3E227FE000
stack
page read and write
7EF000
unkown
page readonly
1E7A4429000
heap
page read and write
1F66B76E000
heap
page read and write
19371459000
heap
page read and write
2531BA29000
heap
page read and write
2A89B03E000
heap
page read and write
400000
unkown
page readonly
23EE000
stack
page read and write
8D5000
heap
page read and write
1F66B7CC000
heap
page read and write
1F66AE13000
heap
page read and write
1F66B743000
heap
page read and write
1DCA1800000
heap
page read and write
401000
unkown
page execute read
1E7A4452000
heap
page read and write
1DCA185C000
heap
page read and write
68C3A7B000
stack
page read and write
E47F07D000
stack
page read and write
1D097F9000
stack
page read and write
2A89B802000
heap
page read and write
1D767C02000
trusted library allocation
page read and write
57426FF000
stack
page read and write
A5D000
heap
page read and write
E47EDFC000
stack
page read and write
3E224FD000
stack
page read and write
10000000
unkown
page readonly
1F66AE8F000
heap
page read and write
6D5C97F000
stack
page read and write
2A89B000000
heap
page read and write
1D098FE000
stack
page read and write
2295603D000
heap
page read and write
786000
unkown
page read and write
2531C202000
trusted library allocation
page read and write
1DCA1610000
heap
page read and write
63F0000
direct allocation
page execute and read and write
A10000
heap
page read and write
174A4402000
trusted library allocation
page read and write
1937122F000
heap
page read and write
19371460000
trusted library allocation
page read and write
193711E0000
heap
page read and write
2A89AF00000
heap
page read and write
193711E8000
heap
page read and write
FB8497F000
stack
page read and write
1D099FF000
stack
page read and write
5741DFB000
stack
page read and write
193711B0000
heap
page read and write
1F66AE5B000
heap
page read and write
2531BA13000
heap
page read and write
1DCA1863000
heap
page read and write
9D6000
heap
page read and write
2A89B939000
heap
page read and write
1E7A4446000
heap
page read and write
1E7A42F0000
heap
page read and write
7CE000
unkown
page read and write
1D7673B0000
heap
page read and write
1DCA185A000
heap
page read and write
174A29F0000
remote allocation
page read and write
A54000
heap
page read and write
22955FE0000
trusted library allocation
page read and write
1DCA1868000
heap
page read and write
10001000
unkown
page execute read
2A89B023000
heap
page read and write
1DCA1865000
heap
page read and write
19371190000
heap
page read and write
A8B70FE000
stack
page read and write
174A2A2A000
heap
page read and write
1F66B700000
heap
page read and write
22956029000
heap
page read and write
7D0000
unkown
page readonly
174A2A4A000
heap
page read and write
1DCA1680000
heap
page read and write
1D767410000
heap
page read and write
A76000
heap
page read and write
A8B73FE000
stack
page read and write
2A89AF90000
trusted library allocation
page read and write
1F66AE87000
heap
page read and write
19371FD0000
trusted library allocation
page read and write
7EF000
unkown
page readonly
174A2860000
heap
page read and write
1F66AE71000
heap
page read and write
1F66AE29000
heap
page read and write
2531BA58000
heap
page read and write
99000
stack
page read and write
1DCA1860000
heap
page read and write
174A2A66000
heap
page read and write
2A89B0E6000
heap
page read and write
E47EE7C000
stack
page read and write
2531BA5B000
heap
page read and write
1F66B813000
heap
page read and write
174A2B18000
heap
page read and write
A8B707B000
stack
page read and write
1DCA1877000
heap
page read and write
1F66AC90000
heap
page read and write
174A2B00000
heap
page read and write
193713F0000
trusted library allocation
page read and write
FB8467D000
stack
page read and write
6D5CA7B000
stack
page read and write
22956038000
heap
page read and write
57422FF000
stack
page read and write
9B0000
heap
page read and write
1DCA187B000
heap
page read and write
5741EFF000
stack
page read and write
920000
heap
page read and write
E47F1FD000
stack
page read and write
2531B9F0000
heap
page read and write
245687E000
stack
page read and write
174A27F0000
heap
page read and write
FB840FC000
stack
page read and write
57425FE000
stack
page read and write
1F66B602000
heap
page read and write
1D0987D000
stack
page read and write
2456A7F000
stack
page read and write
A3F000
heap
page read and write
30000
heap
page read and write
1DCA183D000
heap
page read and write
22956102000
heap
page read and write
19371455000
heap
page read and write
1F66AFB9000
heap
page read and write
1F66AE8F000
heap
page read and write
1F66B7AE000
heap
page read and write
68C34FF000
stack
page read and write
45F0000
direct allocation
page execute and read and write
E47F37E000
stack
page read and write
19371050000
heap
page read and write
2531B980000
heap
page read and write
A73000
heap
page read and write
1E7A4C02000
trusted library allocation
page read and write
19371FB0000
heap
page readonly
174A2A40000
heap
page read and write
174A2A6F000
heap
page read and write
22956000000
heap
page read and write
1F66B802000
heap
page read and write
There are 355 hidden memdumps, click here to show them.