IOC Report
M.V TBN - VESSEL'S DETAILS.docx.scr.exe

loading gif

Files

File Path
Type
Category
Malicious
M.V TBN - VESSEL'S DETAILS.docx.scr.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\M.V TBN - VESSEL'S DETAILS.docx.scr.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe
"C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"
 malicious
C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe
"C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"
 malicious
C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe
"C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"
 malicious
C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe
"C:\Users\user\Desktop\M.V TBN - VESSEL'S DETAILS.docx.scr.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.13.205
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://beirutrest.com
unknown

Domains

Name
IP
Malicious
beirutrest.com
50.87.144.157
 malicious
api.ipify.org
104.26.13.205

IPs

IP
Domain
Country
Malicious
50.87.144.157
beirutrest.com
United States
malicious
104.26.13.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\M_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\M_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\M_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\M_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\M_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\M_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\M_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\M_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\M_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\M_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\M_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\M_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\M_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\M_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
remote allocation
page execute and read and write
 malicious
33CC000
trusted library allocation
page read and write
 malicious
33A1000
trusted library allocation
page read and write
 malicious
38C1000
trusted library allocation
page read and write
 malicious
4DDD000
trusted library allocation
page read and write
517E000
stack
page read and write
49BC000
stack
page read and write
A3AE000
stack
page read and write
68BD000
stack
page read and write
4A2000
unkown
page readonly
B2D000
trusted library allocation
page execute and read and write
7142000
trusted library allocation
page read and write
72FE000
stack
page read and write
1856000
trusted library allocation
page execute and read and write
5FC0000
heap
page read and write
5440000
trusted library allocation
page execute and read and write
70FE000
stack
page read and write
BA3000
heap
page read and write
6EA0000
trusted library allocation
page execute and read and write
4F80000
trusted library allocation
page read and write
B52000
trusted library allocation
page read and write
73B0000
heap
page read and write
5190000
trusted library allocation
page read and write
4A0000
unkown
page readonly
400000
remote allocation
page execute and read and write
B00000
trusted library allocation
page read and write
771E000
stack
page read and write
556000
unkown
page readonly
1850000
trusted library allocation
page read and write
B6E000
heap
page read and write
1560000
heap
page read and write
338F000
trusted library allocation
page read and write
52D0000
heap
page read and write
5874000
trusted library allocation
page read and write
4D32000
trusted library allocation
page read and write
73C0000
trusted library allocation
page execute and read and write
5480000
trusted library section
page read and write
B1D000
trusted library allocation
page execute and read and write
15CF000
heap
page read and write
1589000
heap
page read and write
7014000
trusted library allocation
page read and write
4D40000
trusted library allocation
page read and write
183D000
trusted library allocation
page execute and read and write
271E000
stack
page read and write
1852000
trusted library allocation
page read and write
28C1000
trusted library allocation
page read and write
52C0000
heap
page read and write
4FC0000
heap
page execute and read and write
950000
heap
page read and write
6FBF000
stack
page read and write
1865000
trusted library allocation
page execute and read and write
1880000
trusted library allocation
page read and write
5856000
trusted library allocation
page read and write
1170000
heap
page read and write
584A000
trusted library allocation
page read and write
69BE000
stack
page read and write
110A000
stack
page read and write
1910000
heap
page read and write
1600000
heap
page read and write
B4A000
trusted library allocation
page execute and read and write
713E000
stack
page read and write
7050000
trusted library allocation
page execute and read and write
7610000
heap
page read and write
B14000
trusted library allocation
page read and write
583B000
trusted library allocation
page read and write
4D1E000
trusted library allocation
page read and write
28B0000
heap
page read and write
3351000
trusted library allocation
page read and write
1596000
heap
page read and write
15D7000
heap
page read and write
BA0000
heap
page read and write
4379000
trusted library allocation
page read and write
583E000
trusted library allocation
page read and write
D5F000
stack
page read and write
ACE000
stack
page read and write
153E000
stack
page read and write
5830000
trusted library allocation
page read and write
4F50000
heap
page read and write
184D000
trusted library allocation
page execute and read and write
4F90000
trusted library allocation
page read and write
1917000
heap
page read and write
182E000
stack
page read and write
6BE4000
heap
page read and write
1860000
trusted library allocation
page read and write
733E000
stack
page read and write
6EBE000
stack
page read and write
2790000
heap
page execute and read and write
1830000
trusted library allocation
page read and write
5842000
trusted library allocation
page read and write
737E000
stack
page read and write
4F60000
heap
page read and write
39B3000
trusted library allocation
page read and write
771F000
stack
page read and write
B46000
trusted library allocation
page execute and read and write
4FA0000
trusted library allocation
page execute and read and write
18B0000
heap
page read and write
1862000
trusted library allocation
page read and write
E5F000
stack
page read and write
4D21000
trusted library allocation
page read and write
E70000
trusted library allocation
page read and write
185A000
trusted library allocation
page execute and read and write
F20000
trusted library allocation
page execute and read and write
6E7E000
stack
page read and write
6FF0000
trusted library allocation
page read and write
B96000
heap
page read and write
162B000
heap
page read and write
2780000
trusted library allocation
page read and write
5EA000
stack
page read and write
334E000
stack
page read and write
4DDF000
trusted library allocation
page read and write
33C6000
trusted library allocation
page read and write
3220000
heap
page read and write
5C5C000
stack
page read and write
1867000
trusted library allocation
page execute and read and write
7380000
trusted library allocation
page read and write
3A9E000
trusted library allocation
page read and write
6A40000
heap
page read and write
6FD0000
trusted library allocation
page read and write
1840000
trusted library allocation
page read and write
59DC000
stack
page read and write
18A0000
trusted library allocation
page execute and read and write
B60000
heap
page read and write
4E10000
trusted library allocation
page read and write
B13000
trusted library allocation
page execute and read and write
6FE0000
trusted library allocation
page read and write
4D26000
trusted library allocation
page read and write
6E90000
trusted library allocation
page read and write
4D90000
trusted library allocation
page read and write
75B0000
heap
page read and write
4D60000
trusted library allocation
page read and write
5862000
trusted library allocation
page read and write
11C0000
heap
page read and write
54EE000
stack
page read and write
1568000
heap
page read and write
58A0000
heap
page read and write
B10000
trusted library allocation
page read and write
1A1E000
stack
page read and write
B30000
heap
page read and write
4E33000
heap
page read and write
51A0000
trusted library allocation
page read and write
B42000
trusted library allocation
page read and write
7010000
trusted library allocation
page read and write
EFC000
stack
page read and write
975000
heap
page read and write
3386000
trusted library allocation
page read and write
B5B000
trusted library allocation
page execute and read and write
3240000
heap
page execute and read and write
B20000
trusted library allocation
page read and write
BDD000
heap
page read and write
8CFF000
stack
page read and write
289E000
stack
page read and write
4F70000
heap
page read and write
6C58000
heap
page read and write
6FF0000
trusted library allocation
page read and write
5180000
trusted library allocation
page read and write
1833000
trusted library allocation
page execute and read and write
A1B0000
heap
page read and write
7147000
trusted library allocation
page read and write
8A58000
trusted library allocation
page read and write
C46000
heap
page read and write
43BB000
trusted library allocation
page read and write
4DE0000
trusted library allocation
page execute and read and write
4E21000
trusted library allocation
page read and write
1834000
trusted library allocation
page read and write
4EE0000
trusted library allocation
page read and write
A8E000
stack
page read and write
761E000
stack
page read and write
7000000
trusted library allocation
page execute and read and write
6FF7000
trusted library allocation
page read and write
6CBA000
heap
page read and write
321C000
stack
page read and write
6EB0000
trusted library section
page read and write
6D7E000
stack
page read and write
8F7000
stack
page read and write
28A0000
trusted library allocation
page read and write
B57000
trusted library allocation
page execute and read and write
4DF0000
trusted library allocation
page execute and read and write
157E000
heap
page read and write
4E30000
heap
page read and write
4D00000
trusted library allocation
page read and write
6CC5000
heap
page read and write
52BD000
stack
page read and write
5A10000
heap
page execute and read and write
7F340000
trusted library allocation
page execute and read and write
F37000
heap
page read and write
4D50000
trusted library allocation
page read and write
703D000
stack
page read and write
2923000
trusted library allocation
page read and write
186B000
trusted library allocation
page execute and read and write
5851000
trusted library allocation
page read and write
1A30000
heap
page read and write
1593000
heap
page read and write
15EC000
heap
page read and write
741E000
stack
page read and write
7040000
trusted library allocation
page read and write
18FE000
stack
page read and write
1A37000
heap
page read and write
B40000
trusted library allocation
page read and write
6CBC000
heap
page read and write
6C85000
heap
page read and write
2770000
trusted library allocation
page read and write
EBE000
stack
page read and write
1893000
heap
page read and write
F00000
heap
page read and write
6BB0000
heap
page read and write
7060000
trusted library allocation
page execute and read and write
B69000
heap
page read and write
6FD8000
trusted library allocation
page read and write
33D2000
trusted library allocation
page read and write
51B0000
heap
page read and write
14F9000
stack
page read and write
5880000
trusted library allocation
page read and write
4351000
trusted library allocation
page read and write
53FE000
stack
page read and write
275E000
stack
page read and write
4F3B000
stack
page read and write
7140000
trusted library allocation
page read and write
4DC0000
heap
page read and write
11BE000
stack
page read and write
3391000
trusted library allocation
page read and write
11E5000
heap
page read and write
7FC90000
trusted library allocation
page execute and read and write
C4C000
heap
page read and write
11E0000
heap
page read and write
79C0000
trusted library section
page read and write
7150000
trusted library allocation
page read and write
960000
heap
page read and write
5870000
trusted library allocation
page read and write
5836000
trusted library allocation
page read and write
6DF0000
trusted library section
page read and write
33C8000
trusted library allocation
page read and write
781F000
stack
page read and write
58BA000
heap
page read and write
1900000
trusted library allocation
page read and write
543E000
stack
page read and write
970000
heap
page read and write
4DD0000
trusted library allocation
page read and write
4FB0000
trusted library allocation
page execute and read and write
33CA000
trusted library allocation
page read and write
339D000
trusted library allocation
page read and write
1631000
heap
page read and write
585D000
trusted library allocation
page read and write
4F84000
trusted library allocation
page read and write
1890000
heap
page read and write
1550000
trusted library allocation
page read and write
584E000
trusted library allocation
page read and write
4F40000
trusted library section
page readonly
5358000
trusted library allocation
page read and write
33DE000
trusted library allocation
page read and write
F30000
heap
page read and write
4F55000
heap
page read and write
6FED000
trusted library allocation
page read and write
1A20000
trusted library allocation
page read and write
6CEE000
stack
page read and write
6C40000
heap
page read and write
4D2C000
trusted library allocation
page read and write
52F0000
heap
page read and write
6DEF000
stack
page read and write
There are 248 hidden memdumps, click here to show them.