IOC Report
hesaphareketi-015232024.SCR.exe

loading gif

Files

File Path
Type
Category
Malicious
hesaphareketi-015232024.SCR.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\hesaphareketi-015232024.SCR.exe.log
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe
"C:\Users\user\Desktop\hesaphareketi-015232024.SCR.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
172.67.74.152
http://r3.o.lencr.org0
unknown
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://tqpas.com
unknown
http://r3.i.lencr.org/0
unknown

Domains

Name
IP
Malicious
tqpas.com
91.235.116.231
 malicious
api.ipify.org
172.67.74.152

IPs

IP
Domain
Country
Malicious
91.235.116.231
tqpas.com
Romania
malicious
172.67.74.152
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
3619000
trusted library allocation
page read and write
 malicious
2AEB000
trusted library allocation
page read and write
 malicious
8F8000
heap
page read and write
2E01000
trusted library allocation
page read and write
8D0000
heap
page read and write
5D9F000
heap
page read and write
4AF0000
trusted library allocation
page read and write
2C30000
trusted library allocation
page read and write
27C0000
heap
page execute and read and write
6AA0000
heap
page read and write
2F5C000
trusted library allocation
page read and write
8DE000
heap
page read and write
4AA0000
trusted library allocation
page read and write
788F000
stack
page read and write
5174000
trusted library allocation
page read and write
5DB1000
heap
page read and write
3027000
trusted library allocation
page read and write
4FB0000
heap
page execute and read and write
6D89000
heap
page read and write
91A0000
heap
page read and write
63E6000
trusted library allocation
page read and write
C55000
trusted library allocation
page execute and read and write
92AF000
heap
page read and write
6CFB000
stack
page read and write
F0F000
heap
page read and write
D58C000
stack
page read and write
5D09000
heap
page read and write
905000
heap
page read and write
7A7000
heap
page read and write
557C000
stack
page read and write
91C0000
heap
page read and write
3B49000
trusted library allocation
page read and write
3611000
trusted library allocation
page read and write
2AE7000
trusted library allocation
page read and write
91E2000
heap
page read and write
4A81000
trusted library allocation
page read and write
C42000
trusted library allocation
page read and write
64E0000
trusted library allocation
page execute and read and write
92D1000
heap
page read and write
CD5000
heap
page read and write
2890000
heap
page read and write
35A000
stack
page read and write
5770000
heap
page read and write
923F000
heap
page read and write
2AD2000
trusted library allocation
page read and write
CC0000
trusted library allocation
page execute and read and write
AD6000
trusted library allocation
page execute and read and write
8FB000
heap
page read and write
2816000
trusted library allocation
page read and write
260E000
stack
page read and write
664C000
stack
page read and write
2C43000
trusted library allocation
page read and write
4AC0000
trusted library allocation
page read and write
24F0000
trusted library allocation
page execute and read and write
4F00000
trusted library allocation
page execute and read and write
F61000
heap
page read and write
6A90000
heap
page read and write
299E000
stack
page read and write
4A60000
trusted library allocation
page read and write
C57000
trusted library allocation
page execute and read and write
EAF000
stack
page read and write
4F30000
trusted library allocation
page read and write
272000
unkown
page readonly
7B0000
heap
page read and write
EE90000
heap
page read and write
8C0000
trusted library allocation
page read and write
4A6E000
trusted library allocation
page read and write
2E03000
trusted library allocation
page read and write
2E27000
trusted library allocation
page read and write
C0E000
stack
page read and write
8B4000
trusted library allocation
page read and write
5D29000
heap
page read and write
2660000
trusted library allocation
page read and write
2BFE000
trusted library allocation
page read and write
2B5D000
trusted library allocation
page read and write
AF0000
heap
page read and write
2A9E000
stack
page read and write
7E6000
heap
page read and write
4F9B000
stack
page read and write
261E000
stack
page read and write
611E000
stack
page read and write
F44000
heap
page read and write
3617000
trusted library allocation
page read and write
5D98000
heap
page read and write
2B51000
trusted library allocation
page read and write
6400000
trusted library allocation
page execute and read and write
5CEA000
heap
page read and write
780000
heap
page read and write
5160000
heap
page read and write
470B000
stack
page read and write
527C000
stack
page read and write
5794000
heap
page read and write
6880000
trusted library allocation
page read and write
F11000
heap
page read and write
6BF0000
heap
page read and write
2B9B000
trusted library allocation
page read and write
27BC000
stack
page read and write
625E000
stack
page read and write
4F5E000
stack
page read and write
8C3000
trusted library allocation
page read and write
75BE000
stack
page read and write
2834000
trusted library allocation
page read and write
5DBF000
heap
page read and write
55FD000
stack
page read and write
9192000
heap
page read and write
4B20000
heap
page execute and read and write
4A7E000
trusted library allocation
page read and write
5DA8000
heap
page read and write
77FE000
stack
page read and write
77E000
stack
page read and write
FC9000
heap
page read and write
5620000
trusted library allocation
page read and write
2811000
trusted library allocation
page read and write
2C0A000
trusted library allocation
page read and write
828B000
stack
page read and write
2D31000
trusted library allocation
page read and write
76FE000
stack
page read and write
922C000
heap
page read and write
6860000
heap
page read and write
5000000
heap
page read and write
4FA0000
heap
page read and write
6890000
trusted library allocation
page execute and read and write
561D000
trusted library allocation
page read and write
5CE0000
heap
page read and write
24EB000
stack
page read and write
2CF8000
trusted library allocation
page read and write
51A0000
trusted library allocation
page read and write
5DDB000
heap
page read and write
400000
remote allocation
page execute and read and write
71A000
stack
page read and write
4ABF000
trusted library allocation
page read and write
26BB000
stack
page read and write
4FB0000
heap
page read and write
C46000
trusted library allocation
page execute and read and write
6F62000
trusted library allocation
page read and write
CD0000
heap
page read and write
547C000
stack
page read and write
92CF000
heap
page read and write
2DD7000
trusted library allocation
page read and write
4DA0000
trusted library section
page read and write
26E8000
trusted library allocation
page read and write
4FD0000
heap
page read and write
9263000
heap
page read and write
3003000
trusted library allocation
page read and write
4AB8000
trusted library allocation
page read and write
2ADF000
trusted library allocation
page read and write
2B4D000
trusted library allocation
page read and write
4F40000
trusted library allocation
page execute and read and write
9190000
heap
page read and write
CBE000
stack
page read and write
26D0000
trusted library allocation
page read and write
270000
unkown
page readonly
5CE6000
heap
page read and write
639E000
stack
page read and write
73E000
stack
page read and write
C4A000
trusted library allocation
page execute and read and write
7382000
heap
page read and write
4B9D000
stack
page read and write
91CC000
heap
page read and write
2CAD000
trusted library allocation
page read and write
AE7000
trusted library allocation
page execute and read and write
67DC000
stack
page read and write
5CDD000
stack
page read and write
7E0000
heap
page read and write
8D8000
heap
page read and write
C2D000
trusted library allocation
page execute and read and write
C40000
trusted library allocation
page read and write
4BF3000
heap
page read and write
4AB0000
trusted library allocation
page read and write
2AA1000
trusted library allocation
page read and write
2611000
trusted library allocation
page read and write
63E0000
trusted library allocation
page read and write
5608000
trusted library allocation
page read and write
AF9000
stack
page read and write
7C7000
heap
page read and write
7F370000
trusted library allocation
page execute and read and write
AE2000
trusted library allocation
page read and write
2400000
heap
page read and write
BFF000
stack
page read and write
92A0000
heap
page read and write
9195000
heap
page read and write
2ADB000
trusted library allocation
page read and write
2822000
trusted library allocation
page read and write
AD0000
trusted library allocation
page read and write
4AD0000
trusted library allocation
page read and write
2D48000
trusted library allocation
page read and write
C20000
trusted library allocation
page read and write
2B49000
trusted library allocation
page read and write
629E000
stack
page read and write
8CD000
trusted library allocation
page execute and read and write
4EF0000
trusted library allocation
page read and write
91F5000
heap
page read and write
66DC000
stack
page read and write
ED0000
heap
page read and write
3D0000
heap
page read and write
5070000
heap
page read and write
747E000
stack
page read and write
2C0E000
trusted library allocation
page read and write
8A0000
trusted library allocation
page read and write
50DE000
stack
page read and write
757E000
stack
page read and write
4D9E000
stack
page read and write
5080000
heap
page read and write
64F0000
trusted library allocation
page read and write
64DC000
stack
page read and write
63F0000
trusted library allocation
page read and write
23B0000
trusted library allocation
page read and write
281D000
trusted library allocation
page read and write
2500000
heap
page execute and read and write
790000
heap
page read and write
265B000
stack
page read and write
2B59000
trusted library allocation
page read and write
4F1C000
stack
page read and write
8B3000
trusted library allocation
page execute and read and write
F51000
heap
page read and write
4FC0000
heap
page read and write
27FE000
trusted library allocation
page read and write
5627000
trusted library allocation
page read and write
3B29000
trusted library allocation
page read and write
5DC1000
heap
page read and write
4A90000
trusted library allocation
page read and write
2B17000
trusted library allocation
page read and write
7A0000
heap
page read and write
C30000
trusted library allocation
page read and write
537E000
stack
page read and write
3AC9000
trusted library allocation
page read and write
5D10000
heap
page read and write
668E000
stack
page read and write
2EBA000
trusted library allocation
page read and write
4BF0000
heap
page read and write
91D5000
heap
page read and write
2B75000
trusted library allocation
page read and write
4FFC000
stack
page read and write
6D80000
heap
page read and write
91A4000
heap
page read and write
ADA000
trusted library allocation
page execute and read and write
280E000
trusted library allocation
page read and write
5600000
trusted library allocation
page read and write
AEB000
trusted library allocation
page execute and read and write
27D0000
trusted library allocation
page read and write
268C000
trusted library allocation
page read and write
C70000
trusted library allocation
page read and write
9278000
heap
page read and write
2EE4000
trusted library allocation
page read and write
4F9C000
stack
page read and write
2AE3000
trusted library allocation
page read and write
F9B000
heap
page read and write
C10000
trusted library allocation
page read and write
2802000
trusted library allocation
page read and write
5D92000
heap
page read and write
780000
heap
page read and write
8B0000
trusted library allocation
page read and write
7B5000
heap
page read and write
4A86000
trusted library allocation
page read and write
4A92000
trusted library allocation
page read and write
4A50000
trusted library allocation
page read and write
23FE000
stack
page read and write
5074000
heap
page read and write
F04000
heap
page read and write
FBF000
heap
page read and write
649F000
stack
page read and write
76BE000
stack
page read and write
2DEA000
trusted library allocation
page read and write
5DB9000
heap
page read and write
27FB000
trusted library allocation
page read and write
4BDE000
stack
page read and write
615E000
stack
page read and write
C23000
trusted library allocation
page execute and read and write
68A0000
heap
page read and write
4FC5000
heap
page read and write
3C0000
heap
page read and write
27F0000
trusted library allocation
page read and write
8BD000
trusted library allocation
page execute and read and write
914000
heap
page read and write
4EE0000
heap
page read and write
2FD7000
trusted library allocation
page read and write
6D90000
trusted library allocation
page read and write
2840000
trusted library allocation
page read and write
3AA1000
trusted library allocation
page read and write
EDB000
heap
page read and write
9235000
heap
page read and write
5D00000
heap
page read and write
27E0000
trusted library allocation
page read and write
C24000
trusted library allocation
page read and write
4A64000
trusted library allocation
page read and write
4A6B000
trusted library allocation
page read and write
4F10000
trusted library section
page read and write
C5B000
trusted library allocation
page execute and read and write
2F0A000
trusted library allocation
page read and write
55BC000
stack
page read and write
7C0000
heap
page read and write
2EE6000
trusted library allocation
page read and write
4FA0000
trusted library section
page readonly
5760000
heap
page read and write
ACE000
stack
page read and write
5170000
trusted library allocation
page read and write
91B9000
heap
page read and write
924A000
heap
page read and write
C3D000
trusted library allocation
page execute and read and write
2830000
trusted library allocation
page read and write
EB0000
heap
page read and write
63DD000
stack
page read and write
5EDD000
stack
page read and write
6F8000
stack
page read and write
99B000
heap
page read and write
9200000
heap
page read and write
3B09000
trusted library allocation
page read and write
5610000
trusted library allocation
page read and write
C52000
trusted library allocation
page read and write
4A8D000
trusted library allocation
page read and write
26C0000
trusted library allocation
page read and write
2B55000
trusted library allocation
page read and write
2FEB000
trusted library allocation
page read and write
There are 304 hidden memdumps, click here to show them.