IOC Report
Documents Of DHL -BL- AWB- 8976453410.exe

loading gif

Files

File Path
Type
Category
Malicious
Documents Of DHL -BL- AWB- 8976453410.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Documents Of DHL_a717dd2ed6cc9cb1daf8a386d324cb1affad1e_f07a7b38_8172a8de-ac37-4d37-8223-7185386ef586\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF70B.tmp.dmp
Mini DuMP crash report, 16 streams, Thu May 23 18:23:44 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF910.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF97E.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ane3hooy.1ak.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_eqfjvflz.3vv.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i5rtcrf1.lba.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_x1kfvewo.hf4.psm1
ASCII text, with no line terminators
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Documents Of DHL -BL- AWB- 8976453410.exe
"C:\Users\user\Desktop\Documents Of DHL -BL- AWB- 8976453410.exe"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Documents Of DHL -BL- AWB- 8976453410.exe" -Force
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3812 -s 1324

URLs

Name
IP
Malicious
https://api.telegram.org/bot6814314158:AAEkRl6H9QdGzzoVC6YfWI-wFLiqXO8LEls/sendDocument
149.154.167.220
 malicious
https://api.telegram.org
unknown
 malicious
https://api.telegram.org/bot6814314158:AAEkRl6H9QdGzzoVC6YfWI-wFLiqXO8LEls/
unknown
 malicious
https://api.ipify.org/
172.67.74.152
https://api.ipify.org
unknown
http://upx.sf.net
unknown
https://account.dyn.com/
unknown
http://api.telegram.org
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Domains

Name
IP
Malicious
api.telegram.org
149.154.167.220
 malicious
api.ipify.org
172.67.74.152

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
malicious
172.67.74.152
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
EnableLUA
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance
Enabled
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\regasm_RASMANCS
FileDirectory
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
ProgramId
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
FileId
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
LowerCaseLongPath
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
LongPathHash
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
Name
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
OriginalFileName
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
Publisher
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
Version
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
BinFileVersion
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
BinaryType
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
ProductName
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
ProductVersion
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
LinkDate
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
BinProductVersion
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
AppxPackageFullName
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
AppxPackageRelativeId
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
Size
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
Language
\REGISTRY\A\{e5e93249-4a50-765d-1454-a27525b9adbc}\Root\InventoryApplicationFile\documents of dhl|3c12d9b5b13a6e4a
Usn
There are 26 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
220398D1000
trusted library allocation
page read and write
 malicious
32A8000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
22049842000
trusted library allocation
page read and write
 malicious
22037C31000
heap
page read and write
3150000
heap
page execute and read and write
154E000
stack
page read and write
22037E80000
heap
page execute and read and write
7FFAACE00000
trusted library allocation
page read and write
74EC000
stack
page read and write
780D000
stack
page read and write
15AA000
trusted library allocation
page execute and read and write
22037C1A000
heap
page read and write
15B7000
trusted library allocation
page execute and read and write
70D0000
heap
page read and write
770A000
heap
page read and write
4583000
trusted library allocation
page read and write
6EE06000
unkown
page readonly
7FFAACC6C000
trusted library allocation
page execute and read and write
33FB000
trusted library allocation
page read and write
32EF000
trusted library allocation
page read and write
5880000
heap
page read and write
42D1EFF000
stack
page read and write
5DB0000
trusted library allocation
page read and write
454D000
trusted library allocation
page read and write
E3C3000
trusted library allocation
page read and write
22037EA0000
heap
page execute and read and write
7FFAACC66000
trusted library allocation
page read and write
E3D7000
trusted library allocation
page read and write
667E000
heap
page read and write
42D1CFD000
stack
page read and write
6DFF000
stack
page read and write
32CE000
trusted library allocation
page read and write
5DE0000
heap
page read and write
42D1DFE000
stack
page read and write
42D19FE000
stack
page read and write
7FFAACC96000
trusted library allocation
page execute and read and write
3261000
trusted library allocation
page read and write
22038080000
heap
page read and write
342C000
trusted library allocation
page read and write
6E50000
trusted library allocation
page execute and read and write
840F000
stack
page read and write
7FFB1E3A0000
unkown
page readonly
E39B000
trusted library allocation
page read and write
325C000
stack
page read and write
22037F25000
heap
page read and write
1580000
trusted library allocation
page read and write
7FFAACD60000
trusted library allocation
page read and write
7FFB1E3A1000
unkown
page execute read
71C0000
heap
page read and write
42D20FE000
stack
page read and write
348F000
trusted library allocation
page read and write
2FFE000
stack
page read and write
7FFAACBB0000
trusted library allocation
page read and write
7FFAACDD5000
trusted library allocation
page read and write
1379000
stack
page read and write
E391000
trusted library allocation
page read and write
30FE000
stack
page read and write
7810000
trusted library allocation
page read and write
7FFAACBB3000
trusted library allocation
page execute and read and write
22037E00000
heap
page read and write
36BA000
trusted library allocation
page read and write
329C000
trusted library allocation
page read and write
32F7000
trusted library allocation
page read and write
57C6000
trusted library allocation
page read and write
5CBE000
stack
page read and write
22051FF0000
trusted library section
page read and write
22052096000
heap
page read and write
7FFAACBD4000
trusted library allocation
page read and write
158D000
trusted library allocation
page execute and read and write
67DD000
stack
page read and write
1890000
trusted library allocation
page read and write
7FFAACBC2000
trusted library allocation
page read and write
71CB000
heap
page read and write
348D000
trusted library allocation
page read and write
6CF7000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
C8EE000
trusted library allocation
page read and write
6D50000
trusted library allocation
page execute and read and write
42E9000
trusted library allocation
page read and write
6EDF0000
unkown
page readonly
7FFAACD70000
trusted library allocation
page read and write
7FFB1E3C5000
unkown
page readonly
584C000
stack
page read and write
E3BE000
trusted library allocation
page read and write
1583000
trusted library allocation
page execute and read and write
22039C09000
trusted library allocation
page read and write
4329000
trusted library allocation
page read and write
70C0000
trusted library allocation
page execute and read and write
E387000
trusted library allocation
page read and write
543E000
stack
page read and write
3298000
trusted library allocation
page read and write
57CD000
trusted library allocation
page read and write
2F80000
trusted library allocation
page read and write
7FFAACBDB000
trusted library allocation
page execute and read and write
22037DE0000
heap
page read and write
42D25FB000
stack
page read and write
65DB000
stack
page read and write
6D40000
trusted library allocation
page read and write
22039914000
trusted library allocation
page read and write
22037C34000
heap
page read and write
18A0000
heap
page read and write
726F000
heap
page read and write
64DE000
stack
page read and write
6D60000
trusted library allocation
page execute and read and write
7FFAACC60000
trusted library allocation
page read and write
6CE0000
trusted library allocation
page read and write
65E0000
heap
page read and write
6689000
heap
page read and write
22037BD0000
heap
page read and write
220520FE000
heap
page read and write
7FFAACE10000
trusted library allocation
page read and write
7FFAACD80000
trusted library allocation
page read and write
E3A0000
trusted library allocation
page read and write
365A000
trusted library allocation
page read and write
7264000
heap
page read and write
6CF0000
trusted library allocation
page read and write
330F000
trusted library allocation
page read and write
3322000
trusted library allocation
page read and write
7700000
heap
page read and write
6B5E000
stack
page read and write
7FFAACDB0000
trusted library allocation
page read and write
42D1BFE000
stack
page read and write
71EE000
heap
page read and write
14C0000
heap
page read and write
42C9000
trusted library allocation
page read and write
15D0000
trusted library allocation
page read and write
1590000
trusted library allocation
page read and write
E385000
trusted library allocation
page read and write
4289000
trusted library allocation
page read and write
7FFAACDD0000
trusted library allocation
page read and write
66A3000
heap
page read and write
1584000
trusted library allocation
page read and write
7FFAACBB4000
trusted library allocation
page read and write
43EA000
trusted library allocation
page read and write
452D000
trusted library allocation
page read and write
57D2000
trusted library allocation
page read and write
1570000
trusted library allocation
page read and write
E3D2000
trusted library allocation
page read and write
7FFAACD90000
trusted library allocation
page read and write
5BCD000
stack
page read and write
22051860000
trusted library allocation
page read and write
7FFAACBCD000
trusted library allocation
page execute and read and write
7F9E0000
trusted library allocation
page execute and read and write
71FC000
heap
page read and write
57C1000
trusted library allocation
page read and write
7FFB1E3B6000
unkown
page readonly
44AD000
trusted library allocation
page read and write
6CD8000
trusted library allocation
page read and write
5DA0000
trusted library allocation
page read and write
6616000
heap
page read and write
22037F20000
heap
page read and write
7FFAACD50000
trusted library allocation
page read and write
22037EB0000
trusted library section
page read and write
6BBE000
stack
page read and write
313B000
stack
page read and write
220398B5000
trusted library allocation
page read and write
5ACE000
stack
page read and write
57E0000
trusted library allocation
page read and write
C8E6000
trusted library allocation
page read and write
14F5000
heap
page read and write
3140000
trusted library allocation
page read and write
7FFAACBD0000
trusted library allocation
page read and write
18A6000
heap
page read and write
32A0000
trusted library allocation
page read and write
E3AA000
trusted library allocation
page read and write
7640000
heap
page read and write
33A6000
trusted library allocation
page read and write
14F0000
heap
page read and write
220520DB000
heap
page read and write
42D23FD000
stack
page read and write
7222000
heap
page read and write
B010000
trusted library allocation
page read and write
43AA000
trusted library allocation
page read and write
6CED000
trusted library allocation
page read and write
22037EF0000
heap
page read and write
16CD000
heap
page read and write
15E0000
trusted library allocation
page execute and read and write
36BC000
trusted library allocation
page read and write
163D000
heap
page read and write
1640000
heap
page read and write
7FFAACCD0000
trusted library allocation
page execute and read and write
E38C000
trusted library allocation
page read and write
159D000
trusted library allocation
page execute and read and write
E3A5000
trusted library allocation
page read and write
7FFAACE30000
trusted library allocation
page read and write
220520E1000
heap
page read and write
5D8B000
stack
page read and write
6EE0F000
unkown
page readonly
22037E73000
trusted library allocation
page read and write
42D1FFE000
stack
page read and write
1600000
heap
page read and write
3307000
trusted library allocation
page read and write
45E4000
trusted library allocation
page read and write
33C2000
trusted library allocation
page read and write
16D2000
heap
page read and write
2FA0000
heap
page read and write
15F0000
heap
page read and write
22052111000
heap
page read and write
15A2000
trusted library allocation
page read and write
2204983D000
trusted library allocation
page read and write
22037C5E000
heap
page read and write
65E2000
heap
page read and write
7FFB1E3C0000
unkown
page read and write
14E0000
heap
page read and write
6CD0000
trusted library allocation
page read and write
703C000
stack
page read and write
15A6000
trusted library allocation
page execute and read and write
22037B40000
unkown
page readonly
2F7C000
unkown
page read and write
6EE0D000
unkown
page read and write
14E7000
heap
page read and write
7FFAACDD8000
trusted library allocation
page read and write
22049838000
trusted library allocation
page read and write
5870000
heap
page read and write
42D24FE000
stack
page read and write
4369000
trusted library allocation
page read and write
32F3000
trusted library allocation
page read and write
533C000
stack
page read and write
22037DC0000
heap
page read and write
E3C8000
trusted library allocation
page read and write
2EFF000
stack
page read and write
57F0000
trusted library allocation
page read and write
3303000
trusted library allocation
page read and write
57AB000
trusted library allocation
page read and write
830B000
stack
page read and write
15A0000
trusted library allocation
page read and write
57AE000
trusted library allocation
page read and write
3401000
trusted library allocation
page read and write
4261000
trusted library allocation
page read and write
722C000
heap
page read and write
5874000
heap
page read and write
7FFB1E3C2000
unkown
page readonly
667C000
heap
page read and write
C8E9000
trusted library allocation
page read and write
22052107000
heap
page read and write
15BB000
trusted library allocation
page execute and read and write
16D0000
heap
page read and write
5E2D000
stack
page read and write
5C7E000
stack
page read and write
8720000
heap
page read and write
5860000
heap
page execute and read and write
42D18F2000
stack
page read and write
127A000
stack
page read and write
440000
remote allocation
page execute and read and write
7226000
heap
page read and write
57A0000
trusted library allocation
page read and write
6A5E000
stack
page read and write
7FFAACE20000
trusted library allocation
page read and write
70B0000
trusted library allocation
page read and write
7FFAACE34000
trusted library allocation
page read and write
32FF000
trusted library allocation
page read and write
22037E60000
trusted library allocation
page read and write
6600000
heap
page read and write
7FFAACD95000
trusted library allocation
page read and write
E3AF000
trusted library allocation
page read and write
22039831000
trusted library allocation
page read and write
42D1AFE000
stack
page read and write
22038085000
heap
page read and write
15B5000
trusted library allocation
page execute and read and write
7FFAACDF7000
trusted library allocation
page read and write
8710000
heap
page read and write
22037C1C000
heap
page read and write
22049831000
trusted library allocation
page read and write
7FFAACBBD000
trusted library allocation
page execute and read and write
22037E70000
trusted library allocation
page read and write
330B000
trusted library allocation
page read and write
7FFAACC0C000
trusted library allocation
page execute and read and write
22052090000
heap
page read and write
E3B9000
trusted library allocation
page read and write
6EDF1000
unkown
page execute read
7FFAACDE0000
trusted library allocation
page execute and read and write
57B2000
trusted library allocation
page read and write
22037B42000
unkown
page readonly
5A7C000
stack
page read and write
E3DC000
trusted library allocation
page read and write
662A000
heap
page read and write
6F00000
heap
page read and write
2F3C000
stack
page read and write
22052098000
heap
page read and write
32FB000
trusted library allocation
page read and write
6A1F000
stack
page read and write
6D3E000
stack
page read and write
32A4000
trusted library allocation
page read and write
75EC000
stack
page read and write
2FB0000
trusted library allocation
page execute and read and write
220522D0000
heap
page read and write
7FFAACDC0000
trusted library allocation
page read and write
22037BF0000
heap
page read and write
22037BFC000
heap
page read and write
E3B4000
trusted library allocation
page read and write
5268000
trusted library allocation
page read and write
7080000
trusted library allocation
page read and write
160B000
heap
page read and write
5780000
heap
page read and write
7FFAACDA0000
trusted library allocation
page read and write
7FFAACC70000
trusted library allocation
page execute and read and write
E396000
trusted library allocation
page read and write
7FFAACBDD000
trusted library allocation
page execute and read and write
15B0000
trusted library allocation
page read and write
7280000
heap
page read and write
7FFAACD7C000
trusted library allocation
page read and write
7FFAACBC9000
trusted library allocation
page read and write
7FFAACDF0000
trusted library allocation
page read and write
44ED000
trusted library allocation
page read and write
6E40000
trusted library allocation
page read and write
446D000
trusted library allocation
page read and write
7FFAACBC0000
trusted library allocation
page read and write
22037E40000
trusted library allocation
page read and write
22037C12000
heap
page read and write
6CBE000
stack
page read and write
15B2000
trusted library allocation
page read and write
57BE000
trusted library allocation
page read and write
7FF41D150000
trusted library allocation
page execute and read and write
E3CD000
trusted library allocation
page read and write
13E0000
heap
page read and write
442C000
trusted library allocation
page read and write
There are 307 hidden memdumps, click here to show them.