Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

rinvoice.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.133554625900463
Filename:	rinvoice.exe
Filesize:	1174528
MD5:	70921b4a6f2b97263e1a1f48efe7763b
SHA1:	dc48ad9c39209bb3e3e94f3b35518f3bba9066eb
SHA256:	706f1b6ec843638107f441e0b2d266b997e26ca4d1a040d94bf085740ddcf16c
SHA512:	b7dff05071fee2de30b71e65ec094f5c6cc848bb240611f518f8a757a971d891b35599ff1326a9c12a1618ce8e2e3e76a295365921358fe5fb74244896d30b95
SSDEEP:	24576:qAHnh+eWsN3skA4RV1Hom2KXMmHayaHz0wFQjImX055:9h+ZkldoPK8YayaHIsOXW
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Binary is likely a compiled AutoIt script file	System Summary
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Switches to a custom stack to bypass stack traces	Malware Analysis System Evasion
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to block mouse and keyboard input (often used to hinder debugging)	Anti Debugging
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)	Anti Debugging
Contains functionality to check if a window is minimized (may be used to check if an application is visible)	Hooking and other Techniques for Hiding and Protection
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion	Valid Accounts Access Token Manipulation
Contains functionality to launch a process as a different user	System Summary	Native API
Contains functionality to launch a program with higher privileges	HIPS / PFW / Operating System Protection Evasion	Exploitation for Privilege Escalation
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to read the PEB	Anti Debugging
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	System Shutdown/Reboot
Contains functionality to simulate keystroke presses	HIPS / PFW / Operating System Protection Evasion
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Encrypted Channel
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found large amount of non-executed APIs	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary	Obfuscated Files or Information
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information	System Shutdown/Reboot
Potential key logger detected (key state polling based)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Sample file is different than original file name gathered from version info	System Summary	System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Contains functionality for error logging	System Summary
Contains functionality to add an ACL to a security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary
Contains functionality to check free disk space	System Summary
Contains functionality to create a new security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to instantiate COM classes	System Summary
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery System Information Discovery
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Program exit points	Malware Analysis System Evasion
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
PE file contains a valid data directory to section mapping	System Summary	Security Software Discovery
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\aut183A.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\aut183A.tmp
Category:	dropped
Dump:	aut183A.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\rinvoice.exe
Type:	data
Entropy:	7.898161375319133
Encrypted:	false
Ssdeep:	6144:RsnrImbR/n1YptLLNs4yKUfmWvAJEYz1wLUI:LOnUtNxUONz1wL
Size:	268800
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\aut186A.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\aut186A.tmp
Category:	dropped
Dump:	aut186A.tmp.0.dr
ID:	dr_2
Target ID:	0
Process:	C:\Users\user\Desktop\rinvoice.exe
Type:	data
Entropy:	7.6012008140158756
Encrypted:	false
Ssdeep:	192:65jwEiqxwzMZTG3c6Vg0X9O1JZUv3QfyYxvonMwqrMWJF24Vm0TXzGh6E1:I6qxwzMZy3QU9ObysvoY5j247Tih6o
Size:	9858
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\caprone

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\caprone
Category:	dropped
Dump:	caprone.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\rinvoice.exe
Type:	data
Entropy:	7.898161375319133
Encrypted:	false
Ssdeep:	6144:RsnrImbR/n1YptLLNs4yKUfmWvAJEYz1wLUI:LOnUtNxUONz1wL
Size:	268800
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\undiscernibly

ASCII text, with very long lines (28756), with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\undiscernibly
Category:	dropped
Dump:	undiscernibly.0.dr
ID:	dr_3
Target ID:	0
Process:	C:\Users\user\Desktop\rinvoice.exe
Type:	ASCII text, with very long lines (28756), with no line terminators
Entropy:	3.5928625002975654
Encrypted:	false
Ssdeep:	768:miTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbp+IC6bd4vfF3if6gyuh:miTZ+2QoioGRk6ZklputwjpjBkCiw2R9
Size:	28756
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\rinvoice.exe

"C:\Users\user\Desktop\rinvoice.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6748
Target ID:	0
Parent PID:	2580
Name:	rinvoice.exe
Path:	C:\Users\user\Desktop\rinvoice.exe
Commandline:	"C:\Users\user\Desktop\rinvoice.exe"
Size:	1174528
MD5:	70921B4A6F2B97263E1A1F48EFE7763B
Time:	16:26:00
Date:	01/07/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7a0000
Modulesize:	1200128
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Binary is likely a compiled AutoIt script file	System Summary
Initial sample is a PE file and has a suspicious name	System Summary
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\user\Desktop\rinvoice.exe"

Details

Is windows:	true
Is dropped:	false
PID:	6816
Target ID:	1
Parent PID:	6748
Name:	RegSvcs.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Commandline:	"C:\Users\user\Desktop\rinvoice.exe"
Size:	45984
MD5:	9D352BC46709F0CB5EC974633A0C3C94
Time:	16:26:01
Date:	01/07/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x550000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected PureLog Stealer	Stealing of Sensitive Information, Remote Access Functionality
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected Generic Downloader	Networking
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

URLs

Name

Malicious

http://r3.o.lencr.org0

unknown

Details

Name:	http://r3.o.lencr.org0
TargetID:	1
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000001.00000002.2952038602.00000000054B2000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2950571059.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2949629941.0000000000C46000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://account.dyn.com/

unknown

Details

Name:	https://account.dyn.com/
TargetID:	1
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000001.00000002.2951486882.0000000003A71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2950188294.000000000271F000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2950497744.00000000029E0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2951732022.0000000004F50000.00000004.08000000.00040000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

http://x1.c.lencr.org/0

unknown

Details

Name:	http://x1.c.lencr.org/0
TargetID:	1
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000001.00000002.2949629941.0000000000C6C000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2952038602.00000000054B2000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2950571059.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2949629941.0000000000C46000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://x1.i.lencr.org/0

unknown

Details

Name:	http://x1.i.lencr.org/0
TargetID:	1
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000001.00000002.2949629941.0000000000C6C000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2952038602.00000000054B2000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2950571059.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2949629941.0000000000C46000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://mail.uniform.gr

unknown

http://r3.i.lencr.org/0#

unknown

Details

Name:	http://r3.i.lencr.org/0#
TargetID:	1
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000001.00000002.2952038602.00000000054B2000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2950571059.0000000002ACE000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2949629941.0000000000C46000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://ip-api.com/line/?fields=hosting

208.95.112.1

Details

Name:	http://ip-api.com/line/?fields=hosting
IP:	208.95.112.1
TargetID:	1
From Memory:	false
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
URLs found in memory or binary data	Networking

http://ip-api.com

unknown

Domains

Name

Malicious

mail.uniform.gr

185.25.23.138

Details

Name:	mail.uniform.gr
IP:	185.25.23.138
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

ip-api.com

208.95.112.1

Details

Name:	ip-api.com
IP:	208.95.112.1
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Check if machine is in data center or colocation facility	Malware Analysis System Evasion	Security Software Discovery
HTTP GET or POST without a user agent	Networking
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

208.95.112.1

ip-api.com

United States

185.25.23.138

mail.uniform.gr

Greece

Details

IP:	185.25.23.138
TargetID:	1
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	Greece
Countrycode:	GRC
ASN number:	209150
ASN name:	POINTERGR
Private:	false
Domain:	mail.uniform.gr

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

FileDirectory

There are 5 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

3A71000

trusted library allocation

page read and write

271F000

heap

page read and write

29E0000

trusted library section

page read and write

2AA2000

trusted library allocation

page read and write

2ACE000

trusted library allocation

page read and write

2AF1000

trusted library allocation

page read and write

4F50000

trusted library section

page read and write

2832000

trusted library allocation

page read and write

2510000

trusted library allocation

page read and write

3B76000

trusted library allocation

page read and write

4FD0000

trusted library allocation

page read and write

24E3000

trusted library allocation

page read and write

170E000

stack

page read and write

6930000

heap

page read and write

EA0000

direct allocation

page read and write

A30000

heap

page read and write

2826000

trusted library allocation

page read and write

2AF9000

trusted library allocation

page read and write

A60000

heap

page read and write

FAC000

heap

page read and write

39E9000

direct allocation

page read and write

82F000

unkown

page readonly

39ED000

direct allocation

page read and write

4FF0000

heap

page read and write

7A1000

unkown

page execute read

FAA000

heap

page read and write

DF0000

heap

page read and write

FB8000

heap

page read and write

3B34000

trusted library allocation

page read and write

532C000

stack

page read and write

109A000

heap

page read and write

29DE000

stack

page read and write

10CE000

heap

page read and write

C8F000

stack

page read and write

6580000

trusted library allocation

page read and write

3893000

direct allocation

page read and write

5770000

heap

page read and write

283A000

trusted library allocation

page read and write

82F000

unkown

page readonly

1B0E000

stack

page read and write

863000

unkown

page write copy

7A0000

unkown

page readonly

8F8000

stack

page read and write

28C0000

trusted library allocation

page read and write

24FA000

trusted library allocation

page execute and read and write

4C0D000

stack

page read and write

426000

system

page execute and read and write

6450000

trusted library allocation

page read and write

10C9000

heap

page read and write

24D4000

trusted library allocation

page read and write

24ED000

trusted library allocation

page execute and read and write

39ED000

direct allocation

page read and write

BB0000

trusted library section

page read and write

3A39000

direct allocation

page read and write

BC0000

heap

page read and write

3A3D000

direct allocation

page read and write

24F0000

trusted library allocation

page read and write

2A50000

trusted library allocation

page read and write

7A0000

unkown

page readonly

3A3D000

direct allocation

page read and write

5EA000

stack

page read and write

2A60000

heap

page execute and read and write

3770000

direct allocation

page read and write

284D000

trusted library allocation

page read and write

F10000

heap

page read and write

D0D000

stack

page read and write

632E000

stack

page read and write

3843000

direct allocation

page read and write

F4B000

heap

page read and write

3770000

direct allocation

page read and write

CCD000

stack

page read and write

5790000

trusted library allocation

page read and write

64A7000

trusted library allocation

page read and write

7FB40000

trusted library allocation

page execute and read and write

3770000

direct allocation

page read and write

4FDD000

trusted library allocation

page read and write

2517000

trusted library allocation

page execute and read and write

6430000

trusted library allocation

page execute and read and write

3A5E000

direct allocation

page read and write

3720000

direct allocation

page read and write

855000

unkown

page readonly

855000

unkown

page readonly

3A5E000

direct allocation

page read and write

61ED000

stack

page read and write

5780000

trusted library allocation

page execute and read and write

DD0000

direct allocation

page execute and read and write

5470000

heap

page read and write

5488000

heap

page read and write

3843000

direct allocation

page read and write

2587000

heap

page read and write

536E000

stack

page read and write

3A3D000

direct allocation

page read and write

1095000

heap

page read and write

3AAE000

direct allocation

page read and write

28BE000

stack

page read and write

522C000

stack

page read and write

653E000

stack

page read and write

102B000

heap

page read and write

257E000

stack

page read and write

3893000

direct allocation

page read and write

2870000

heap

page read and write

3A39000

direct allocation

page read and write

24D0000

trusted library allocation

page read and write

5794000

trusted library allocation

page read and write

2A71000

trusted library allocation

page read and write

DB0000

heap

page read and write

24C0000

trusted library allocation

page read and write

28D0000

heap

page read and write

546E000

stack

page read and write

38C0000

direct allocation

page read and write

283E000

trusted library allocation

page read and write

2500000

heap

page read and write

FB8000

heap

page read and write

2846000

trusted library allocation

page read and write

2AE0000

trusted library allocation

page read and write

F4E000

heap

page read and write

4A78000

trusted library allocation

page read and write

2512000

trusted library allocation

page read and write

56ED000

stack

page read and write

3AAE000

direct allocation

page read and write

C6C000

heap

page read and write

54B2000

heap

page read and write

2B01000

trusted library allocation

page read and write

FB8000

heap

page read and write

282B000

trusted library allocation

page read and write

FB8000

heap

page read and write

282E000

trusted library allocation

page read and write

A50000

trusted library section

page read and write

FB8000

heap

page read and write

F4E000

heap

page read and write

6440000

trusted library allocation

page read and write

10C9000

heap

page read and write

E90000

heap

page read and write

F91000

heap

page read and write

85F000

unkown

page write copy

2530000

trusted library allocation

page read and write

2820000

trusted library allocation

page read and write

649E000

stack

page read and write

56AF000

stack

page read and write

CAB000

stack

page read and write

51EE000

stack

page read and write

6B0000

heap

page read and write

10B9000

heap

page read and write

FD8000

heap

page read and write

85F000

unkown

page read and write

39E9000

direct allocation

page read and write

10B9000

heap

page read and write

3893000

direct allocation

page read and write

3A5E000

direct allocation

page read and write

39E9000

direct allocation

page read and write

109A000

heap

page read and write

24F2000

trusted library allocation

page read and write

F18000

heap

page read and write

24A0000

heap

page read and write

3910000

direct allocation

page read and write

4FE0000

heap

page execute and read and write

3843000

direct allocation

page read and write

2580000

heap

page read and write

24E0000

trusted library allocation

page read and write

BFC000

heap

page read and write

25E0000

trusted library allocation

page read and write

2841000

trusted library allocation

page read and write

445000

system

page execute and read and write

3AAE000

direct allocation

page read and write

55AE000

stack

page read and write

24F6000

trusted library allocation

page execute and read and write

6590000

trusted library allocation

page read and write

400000

system

page execute and read and write

FB9000

heap

page read and write

C46000

heap

page read and write

2515000

trusted library allocation

page execute and read and write

C9F000

stack

page read and write

F4E000

heap

page read and write

642D000

stack

page read and write

104D000

heap

page read and write

6910000

trusted library allocation

page execute and read and write

25F0000

heap

page read and write

24DD000

trusted library allocation

page execute and read and write

BEF000

heap

page read and write

C32000

heap

page read and write

10AA000

heap

page read and write

790000

heap

page read and write

950000

heap

page read and write

659000

stack

page read and write

D4E000

stack

page read and write

2860000

trusted library allocation

page read and write

3720000

direct allocation

page read and write

2810000

trusted library allocation

page read and write

25D0000

trusted library allocation

page execute and read and write

2ACC000

trusted library allocation

page read and write

3A39000

direct allocation

page read and write

251B000

trusted library allocation

page execute and read and write

3910000

direct allocation

page read and write

F43000

heap

page read and write

BF9000

heap

page read and write

5E4E000

stack

page read and write

7A1000

unkown

page execute read

38C0000

direct allocation

page read and write

A65000

heap

page read and write

39ED000

direct allocation

page read and write

6458000

trusted library allocation

page read and write

F42000

heap

page read and write

868000

unkown

page readonly

38C0000

direct allocation

page read and write

C2A000

heap

page read and write

E94000

heap

page read and write

3910000

direct allocation

page read and write

FAB000

heap

page read and write

BC8000

heap

page read and write

3720000

direct allocation

page read and write

2AED000

trusted library allocation

page read and write

1C30000

heap

page read and write

25CC000

stack

page read and write

64A0000

trusted library allocation

page read and write

2503000

heap

page read and write

FB8000

heap

page read and write

868000

unkown

page readonly

24D3000

trusted library allocation

page execute and read and write

62EF000

stack

page read and write

6C10000

heap

page read and write

FAB000

heap

page read and write

There are 211 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
rinvoice.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Reportrinvoice.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
rinvoice.exe