IOC Report
PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED.xlsx.scr.exe

loading gif

Files

File Path
Type
Category
Malicious
PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED.xlsx.scr.exe
PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED.xlsx.scr.exe.log
CSV text
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED.xlsx.scr.exe
"C:\Users\user\Desktop\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED.xlsx.scr.exe"
 malicious
C:\Users\user\Desktop\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED.xlsx.scr.exe
"C:\Users\user\Desktop\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED.xlsx.scr.exe"
 malicious

URLs

Name
IP
Malicious
https://reallyfreegeoip.org
unknown
http://checkip.dyndns.org
unknown
http://checkip.dyndns.orgp
unknown
https://reallyfreegeoip.org/xml/8.46.123.33p
unknown
http://checkip.dyndns.org/
193.122.6.168
http://checkip.dyndns.com
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.96.3
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://checkip.dyndns.org/q
unknown
http://reallyfreegeoip.org
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.96.3
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
193.122.6.168

IPs

IP
Domain
Country
Malicious
188.114.96.3
reallyfreegeoip.org
European Union
malicious
193.122.6.168
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PETUNJUK-PENGISIAN DAN PENGIRIMAN KONFIRMASI EDITED_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
13625000
trusted library allocation
page read and write
 malicious
140002000
remote allocation
page execute and read and write
 malicious
34E1000
trusted library allocation
page read and write
 malicious
13431000
trusted library allocation
page read and write
 malicious
3732000
trusted library allocation
page read and write
 malicious
2E9A000
heap
page read and write
3816000
trusted library allocation
page read and write
37E7000
trusted library allocation
page read and write
7FF848E3C000
trusted library allocation
page execute and read and write
1C0B0000
heap
page read and write
363E000
trusted library allocation
page read and write
1C255000
heap
page read and write
1C1E0000
trusted library allocation
page read and write
1ED10000
heap
page read and write
2E90000
heap
page read and write
2E80000
trusted library section
page read and write
7FF849004000
trusted library allocation
page read and write
7FF848E10000
trusted library allocation
page read and write
A40000
heap
page read and write
7FF848EBC000
trusted library allocation
page execute and read and write
3698000
trusted library allocation
page read and write
15CE000
stack
page read and write
7FF848E04000
trusted library allocation
page read and write
7FF848FD3000
trusted library allocation
page read and write
3010000
heap
page execute and read and write
1BF1A000
heap
page read and write
36AF000
trusted library allocation
page read and write
EA1000
heap
page read and write
7FF848E9C000
trusted library allocation
page execute and read and write
3618000
trusted library allocation
page read and write
1C1A0000
trusted library section
page read and write
1C340000
heap
page execute and read and write
7FF848F90000
trusted library allocation
page execute and read and write
2D7E000
heap
page read and write
D60000
heap
page execute and read and write
13421000
trusted library allocation
page read and write
1353B000
trusted library allocation
page read and write
7FF848FB0000
trusted library allocation
page execute and read and write
322000
unkown
page readonly
7FF848FE6000
trusted library allocation
page read and write
13428000
trusted library allocation
page read and write
E89000
heap
page read and write
1E34F000
stack
page read and write
3646000
trusted library allocation
page read and write
E00000
heap
page read and write
13578000
trusted library allocation
page read and write
CD0000
trusted library allocation
page read and write
1F45E000
stack
page read and write
F29000
heap
page read and write
36EA000
trusted library allocation
page read and write
E80000
heap
page read and write
7FF403020000
trusted library allocation
page execute and read and write
1C1D3000
heap
page read and write
140000000
remote allocation
page execute and read and write
7FF848E90000
trusted library allocation
page read and write
B77000
heap
page read and write
3630000
trusted library allocation
page read and write
7FF848E5C000
trusted library allocation
page execute and read and write
7FF848E04000
trusted library allocation
page read and write
A70000
heap
page read and write
3680000
trusted library allocation
page read and write
10B0000
heap
page read and write
DA5000
heap
page read and write
CB0000
trusted library allocation
page read and write
13553000
trusted library allocation
page read and write
A50000
heap
page read and write
3829000
trusted library allocation
page read and write
1E74E000
stack
page read and write
1B450000
trusted library allocation
page read and write
7FF849000000
trusted library allocation
page read and write
3642000
trusted library allocation
page read and write
7FF848E00000
trusted library allocation
page read and write
369C000
trusted library allocation
page read and write
7FF848DE0000
trusted library allocation
page read and write
AD1000
heap
page read and write
7FF848EC0000
trusted library allocation
page execute and read and write
11CE000
stack
page read and write
1E45D000
stack
page read and write
7FF848F00000
trusted library allocation
page execute and read and write
1C142000
heap
page read and write
1EC5F000
stack
page read and write
36C3000
trusted library allocation
page read and write
F80000
trusted library allocation
page read and write
D30000
heap
page read and write
7FF848FF9000
trusted library allocation
page read and write
1135000
heap
page read and write
153E000
stack
page read and write
3707000
trusted library allocation
page read and write
7FF848E0B000
trusted library allocation
page execute and read and write
B7C000
heap
page read and write
370B000
trusted library allocation
page read and write
7FF848FB0000
trusted library allocation
page read and write
1D680000
heap
page read and write
A9C000
heap
page read and write
7FF848E2B000
trusted library allocation
page execute and read and write
1C093000
heap
page read and write
3421000
trusted library allocation
page read and write
7FF848FE3000
trusted library allocation
page read and write
7FF848FA0000
trusted library allocation
page read and write
A96000
heap
page read and write
37CF000
trusted library allocation
page read and write
7FF848EB0000
trusted library allocation
page read and write
DC5000
heap
page read and write
1BEE0000
heap
page read and write
6D0000
heap
page read and write
37E2000
trusted library allocation
page read and write
1F05F000
stack
page read and write
1BB9B000
stack
page read and write
193E000
stack
page read and write
1D8D0000
trusted library section
page read and write
1C070000
trusted library section
page read and write
AFE000
heap
page read and write
1BD6D000
stack
page read and write
9EE000
stack
page read and write
7FF848EC6000
trusted library allocation
page execute and read and write
13584000
trusted library allocation
page read and write
1C090000
heap
page read and write
7FF848E00000
trusted library allocation
page read and write
3822000
trusted library allocation
page read and write
7FF848EB6000
trusted library allocation
page read and write
DA0000
heap
page read and write
7FF848FD0000
trusted library allocation
page execute and read and write
7FF848DE2000
trusted library allocation
page read and write
7FF848E03000
trusted library allocation
page execute and read and write
AFC000
heap
page read and write
341F000
stack
page read and write
1130000
heap
page read and write
134E1000
trusted library allocation
page read and write
7FF848FC0000
trusted library allocation
page read and write
7FF848F80000
trusted library allocation
page read and write
371E000
trusted library allocation
page read and write
1050000
heap
page read and write
1C0FF000
heap
page read and write
3694000
trusted library allocation
page read and write
34DE000
stack
page read and write
7FF848DF0000
trusted library allocation
page read and write
7FF848FF0000
trusted library allocation
page read and write
ABC000
heap
page read and write
E60000
trusted library allocation
page read and write
7FF848EE6000
trusted library allocation
page execute and read and write
EBD000
heap
page read and write
DF2000
stack
page read and write
1C250000
heap
page read and write
7FF848E20000
trusted library allocation
page read and write
36D6000
trusted library allocation
page read and write
1D76B000
heap
page read and write
3690000
trusted library allocation
page read and write
7FF848FA0000
trusted library allocation
page read and write
7FF848E13000
trusted library allocation
page read and write
F83000
trusted library allocation
page read and write
7FF848E0D000
trusted library allocation
page execute and read and write
1C74E000
stack
page read and write
102E000
stack
page read and write
7FF848EA0000
trusted library allocation
page execute and read and write
7FF848E2D000
trusted library allocation
page execute and read and write
1D75F000
heap
page read and write
7D0000
heap
page read and write
E40000
trusted library allocation
page read and write
1C1C0000
heap
page read and write
7FF848FE0000
trusted library allocation
page read and write
1C0FC000
heap
page read and write
7FF848DE4000
trusted library allocation
page read and write
C60000
heap
page read and write
109F000
stack
page read and write
1DC82000
trusted library allocation
page read and write
DC0000
heap
page read and write
B05000
heap
page read and write
1356E000
trusted library allocation
page read and write
7FF848DE3000
trusted library allocation
page execute and read and write
37C9000
trusted library allocation
page read and write
381C000
trusted library allocation
page read and write
7B0000
heap
page read and write
7FF848E24000
trusted library allocation
page read and write
1055000
heap
page read and write
EBF000
heap
page read and write
1BEF0000
heap
page read and write
7FF848FD7000
trusted library allocation
page read and write
320000
unkown
page readonly
7FF848FD0000
trusted library allocation
page read and write
1E85E000
stack
page read and write
7FF848DED000
trusted library allocation
page execute and read and write
1C1D0000
heap
page read and write
1D940000
heap
page read and write
A90000
heap
page read and write
7FF848DF3000
trusted library allocation
page read and write
7FF848E0D000
trusted library allocation
page execute and read and write
7FF848FFD000
trusted library allocation
page read and write
35F8000
trusted library allocation
page read and write
3688000
trusted library allocation
page read and write
1C0A0000
heap
page read and write
D70000
trusted library section
page readonly
37EB000
trusted library allocation
page read and write
3862000
trusted library allocation
page read and write
7FF848DFD000
trusted library allocation
page execute and read and write
7FF848E02000
trusted library allocation
page read and write
368C000
trusted library allocation
page read and write
37D8000
trusted library allocation
page read and write
37C4000
trusted library allocation
page read and write
363A000
trusted library allocation
page read and write
3684000
trusted library allocation
page read and write
1C270000
heap
page read and write
E70000
heap
page execute and read and write
1C67D000
stack
page read and write
B72000
heap
page read and write
AD4000
heap
page read and write
FE0000
heap
page read and write
1EB4E000
stack
page read and write
7FF848FC0000
trusted library allocation
page execute and read and write
EE9000
heap
page read and write
7FF848E96000
trusted library allocation
page read and write
D80000
heap
page read and write
7FF848FE0000
trusted library allocation
page execute and read and write
7FF848F20000
trusted library allocation
page execute and read and write
34BB000
trusted library allocation
page read and write
7FF848E1D000
trusted library allocation
page execute and read and write
EA7000
heap
page read and write
There are 206 hidden memdumps, click here to show them.