IOC Report
New Order.exe

loading gif

Files

File Path
Type
Category
Malicious
New Order.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\Anglophile
data
dropped
C:\Users\user\AppData\Local\Temp\ageless
ASCII text, with very long lines (28674), with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\autC751.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\autC7A0.tmp
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\New Order.exe
"C:\Users\user\Desktop\New Order.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\New Order.exe"
 malicious

URLs

Name
IP
Malicious
https://www.office.com/
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://api.telegram.org
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://api.telegram.org/bot
unknown
http://mail.lenteraandalan.com
unknown
https://www.office.com/lB
unknown
https://chrome.google.com/webstore?hl=enp
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://checkip.dyndns.org
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.96.3
https://api.telegram.org/bot/sendMessage?chat_id=&text=
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20a
unknown
https://chrome.google.com/webstore?hl=en
unknown
https://www.ecosia.org/newtab/
unknown
http://varders.kozow.com:8081
unknown
http://aborters.duckdns.org:8081
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://checkip.dyndns.org/
193.122.130.0
http://51.38.247.67:8081/_send_.php?L
unknown
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
http://lenteraandalan.com
unknown
https://www.office.com/p
unknown
http://anotherarmy.dns.army:8081
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://checkip.dyndns.org/q
unknown
https://chrome.google.com/webstore?hl=enlB
unknown
https://reallyfreegeoip.org
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:405464%0D%0ADate%20and%20Time:%2026/07/2024%20/%2001:41:43%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20405464%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D
149.154.167.220
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 25 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.96.3
 malicious
api.telegram.org
149.154.167.220
 malicious
lenteraandalan.com
103.163.138.29
 malicious
checkip.dyndns.org
unknown
 malicious
mail.lenteraandalan.com
unknown
 malicious
56.126.166.20.in-addr.arpa
unknown
 malicious
checkip.dyndns.com
193.122.130.0

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
malicious
103.163.138.29
lenteraandalan.com
unknown
malicious
188.114.96.3
reallyfreegeoip.org
European Union
malicious
193.122.130.0
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SystemRestore
DisableSR
 malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
DisableTaskMgr
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 7 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2B48000
heap
page read and write
 malicious
2E01000
trusted library allocation
page read and write
 malicious
5470000
trusted library section
page read and write
 malicious
53E0000
trusted library section
page read and write
 malicious
53DE000
stack
page read and write
3F10000
direct allocation
page read and write
14D0000
heap
page read and write
5516000
heap
page read and write
3084000
trusted library allocation
page read and write
653E000
stack
page read and write
6910000
trusted library allocation
page execute and read and write
4039000
direct allocation
page read and write
1550000
heap
page read and write
2A60000
trusted library allocation
page read and write
2F3C000
trusted library allocation
page read and write
66FF000
stack
page read and write
1639000
heap
page read and write
D37000
stack
page read and write
6BC2000
trusted library allocation
page read and write
3E8E000
trusted library allocation
page read and write
1040000
heap
page read and write
54D0000
heap
page execute and read and write
139E000
stack
page read and write
416E000
trusted library allocation
page read and write
14D4000
heap
page read and write
1803000
heap
page read and write
1240000
heap
page read and write
30A9000
trusted library allocation
page read and write
403D000
direct allocation
page read and write
F10000
trusted library section
page read and write
40B5000
trusted library allocation
page read and write
2A56000
trusted library allocation
page execute and read and write
6BC5000
trusted library allocation
page read and write
3E93000
direct allocation
page read and write
544A000
trusted library allocation
page read and write
4194000
trusted library allocation
page read and write
5B8B000
trusted library allocation
page read and write
3071000
trusted library allocation
page read and write
3FB8000
trusted library allocation
page read and write
417B000
trusted library allocation
page read and write
402A000
trusted library allocation
page read and write
3F0B000
trusted library allocation
page read and write
30E0000
trusted library allocation
page read and write
17F9000
heap
page read and write
14E0000
direct allocation
page read and write
390000
unkown
page write copy
15D5000
heap
page read and write
3F07000
trusted library allocation
page read and write
2F40000
trusted library allocation
page read and write
4137000
trusted library allocation
page read and write
5B89000
trusted library allocation
page read and write
3D70000
direct allocation
page read and write
5B6E000
stack
page read and write
EAE000
stack
page read and write
6DD0000
trusted library allocation
page read and write
419F000
trusted library allocation
page read and write
3E2F000
trusted library allocation
page read and write
10D0000
heap
page read and write
68E0000
trusted library allocation
page read and write
2FA5000
trusted library allocation
page read and write
40AF000
trusted library allocation
page read and write
11CE000
stack
page read and write
4219000
trusted library allocation
page read and write
40BC000
trusted library allocation
page read and write
6E30000
trusted library allocation
page read and write
1100000
heap
page read and write
1648000
heap
page read and write
1807000
heap
page read and write
403D000
direct allocation
page read and write
11DB000
stack
page read and write
4161000
trusted library allocation
page read and write
2C0000
unkown
page readonly
16CF000
heap
page read and write
3EC6000
trusted library allocation
page read and write
11FF000
stack
page read and write
30D4000
trusted library allocation
page read and write
4146000
trusted library allocation
page read and write
103E000
stack
page read and write
54EC000
heap
page read and write
10A0000
heap
page read and write
2E75000
trusted library allocation
page read and write
3E59000
trusted library allocation
page read and write
568B000
trusted library allocation
page read and write
3D70000
direct allocation
page read and write
6940000
trusted library allocation
page execute and read and write
5456000
trusted library allocation
page read and write
413B000
trusted library allocation
page read and write
2DD0000
trusted library allocation
page read and write
544E000
trusted library allocation
page read and write
17A9000
heap
page read and write
3221000
trusted library allocation
page read and write
F30000
heap
page read and write
11BF000
stack
page read and write
409F000
trusted library allocation
page read and write
5A6E000
stack
page read and write
2A52000
trusted library allocation
page read and write
5610000
trusted library allocation
page execute and read and write
15C5000
heap
page read and write
6DF0000
trusted library allocation
page read and write
1083000
heap
page read and write
2AB0000
heap
page execute and read and write
5680000
trusted library allocation
page read and write
2A50000
trusted library allocation
page read and write
3E01000
trusted library allocation
page read and write
2EBB000
trusted library allocation
page read and write
54EA000
heap
page read and write
414F000
trusted library allocation
page read and write
2A5A000
trusted library allocation
page execute and read and write
2FAA000
trusted library allocation
page read and write
2F6E000
trusted library allocation
page read and write
2EAB000
trusted library allocation
page read and write
5600000
trusted library allocation
page read and write
16E8000
heap
page read and write
F35000
heap
page read and write
2F9B000
trusted library allocation
page read and write
166A000
heap
page read and write
55E0000
trusted library allocation
page read and write
180B000
heap
page read and write
219E000
stack
page read and write
403D000
direct allocation
page read and write
2EC3000
trusted library allocation
page read and write
68E9000
trusted library allocation
page read and write
307B000
trusted library allocation
page read and write
2F97000
trusted library allocation
page read and write
2C1000
unkown
page execute read
14C0000
direct allocation
page execute and read and write
2A90000
trusted library allocation
page execute and read and write
4182000
trusted library allocation
page read and write
BDA000
stack
page read and write
40C1000
trusted library allocation
page read and write
55AB000
heap
page read and write
3FF6000
trusted library allocation
page read and write
1090000
trusted library allocation
page read and write
68D0000
trusted library allocation
page read and write
3E93000
direct allocation
page read and write
394000
unkown
page readonly
F0E000
stack
page read and write
15DA000
heap
page read and write
3E79000
trusted library allocation
page read and write
3FA3000
trusted library allocation
page read and write
4203000
trusted library allocation
page read and write
1627000
heap
page read and write
15A0000
heap
page read and write
6900000
trusted library allocation
page read and write
4155000
trusted library allocation
page read and write
3F10000
direct allocation
page read and write
1628000
heap
page read and write
13B0000
heap
page read and write
67BE000
stack
page read and write
11EF000
stack
page read and write
394000
unkown
page readonly
543B000
trusted library allocation
page read and write
1094000
trusted library allocation
page read and write
2A40000
trusted library allocation
page read and write
4015000
trusted library allocation
page read and write
135E000
stack
page read and write
2F66000
trusted library allocation
page read and write
6BA0000
trusted library allocation
page read and write
2F6A000
trusted library allocation
page read and write
6BC0000
trusted library allocation
page read and write
6950000
trusted library allocation
page execute and read and write
3EA1000
trusted library allocation
page read and write
3E93000
direct allocation
page read and write
3F10000
direct allocation
page read and write
111A000
heap
page read and write
65FE000
stack
page read and write
D90000
heap
page read and write
15D8000
heap
page read and write
5430000
trusted library allocation
page read and write
3F10000
direct allocation
page read and write
2F6C000
trusted library allocation
page read and write
2EE8000
trusted library allocation
page read and write
2E60000
trusted library allocation
page read and write
677F000
stack
page read and write
1070000
trusted library allocation
page read and write
17B4000
heap
page read and write
2EB3000
trusted library allocation
page read and write
4149000
trusted library allocation
page read and write
2F9F000
trusted library allocation
page read and write
168B000
heap
page read and write
30DA000
trusted library allocation
page read and write
5B8E000
trusted library allocation
page read and write
2DC0000
heap
page read and write
426000
system
page execute and read and write
6E20000
heap
page read and write
4039000
direct allocation
page read and write
C3A000
stack
page read and write
6B9E000
stack
page read and write
418D000
trusted library allocation
page read and write
6DE0000
trusted library allocation
page execute and read and write
2A3E000
stack
page read and write
2A80000
trusted library allocation
page read and write
2EBF000
trusted library allocation
page read and write
2F54000
trusted library allocation
page read and write
2B10000
trusted library allocation
page read and write
2F9D000
trusted library allocation
page read and write
419A000
trusted library allocation
page read and write
2AA0000
trusted library allocation
page read and write
3FF9000
trusted library allocation
page read and write
543E000
trusted library allocation
page read and write
5500000
heap
page read and write
173C000
heap
page read and write
3E07000
trusted library allocation
page read and write
2E79000
trusted library allocation
page read and write
54E0000
heap
page read and write
2EA2000
trusted library allocation
page read and write
40AE000
direct allocation
page read and write
4144000
trusted library allocation
page read and write
2D2F000
stack
page read and write
2B20000
heap
page read and write
40AE000
direct allocation
page read and write
112C000
heap
page read and write
3076000
trusted library allocation
page read and write
567E000
stack
page read and write
54E4000
heap
page read and write
657D000
stack
page read and write
1060000
trusted library section
page read and write
2EAF000
trusted library allocation
page read and write
166B000
heap
page read and write
F20000
heap
page read and write
30DC000
trusted library allocation
page read and write
6920000
trusted library allocation
page read and write
3D70000
direct allocation
page read and write
38C000
unkown
page write copy
6E60000
heap
page read and write
3050000
trusted library allocation
page read and write
30CE000
trusted library allocation
page read and write
14A0000
heap
page read and write
382000
unkown
page readonly
5543000
heap
page read and write
4039000
direct allocation
page read and write
35C000
unkown
page readonly
2F74000
trusted library allocation
page read and write
3080000
trusted library allocation
page read and write
13A0000
heap
page read and write
3E93000
direct allocation
page read and write
10A8000
heap
page read and write
3F37000
trusted library allocation
page read and write
6A9E000
stack
page read and write
30D6000
trusted library allocation
page read and write
35C000
unkown
page readonly
38C000
unkown
page read and write
545D000
trusted library allocation
page read and write
2C1000
unkown
page execute read
3E93000
direct allocation
page read and write
2DB0000
trusted library allocation
page read and write
2C0000
unkown
page readonly
68F0000
trusted library allocation
page execute and read and write
43E000
system
page execute and read and write
10F0000
heap
page read and write
3E1C000
trusted library allocation
page read and write
2DF0000
heap
page read and write
2F79000
trusted library allocation
page read and write
403D000
direct allocation
page read and write
41B7000
trusted library allocation
page read and write
171F000
heap
page read and write
40AE000
direct allocation
page read and write
2A4D000
trusted library allocation
page execute and read and write
4131000
trusted library allocation
page read and write
4E00000
trusted library allocation
page read and write
2F46000
trusted library allocation
page read and write
2DAE000
stack
page read and write
2F0D000
trusted library allocation
page read and write
2AFE000
stack
page read and write
2E6B000
trusted library allocation
page read and write
2EA6000
trusted library allocation
page read and write
4089000
trusted library allocation
page read and write
4F9E000
stack
page read and write
41E3000
trusted library allocation
page read and write
2EB7000
trusted library allocation
page read and write
382000
unkown
page readonly
3E5D000
trusted library allocation
page read and write
40AE000
direct allocation
page read and write
2A6B000
trusted library allocation
page execute and read and write
5730000
heap
page read and write
4140000
trusted library allocation
page read and write
68BE000
stack
page read and write
3FCB000
trusted library allocation
page read and write
2F0B000
trusted library allocation
page read and write
4039000
direct allocation
page read and write
3D70000
direct allocation
page read and write
2E54000
trusted library allocation
page read and write
4124000
trusted library allocation
page read and write
673E000
stack
page read and write
3D70000
direct allocation
page read and write
65BE000
stack
page read and write
2D6C000
stack
page read and write
109D000
trusted library allocation
page execute and read and write
5B80000
trusted library allocation
page read and write
1D9E000
stack
page read and write
15A8000
heap
page read and write
40AE000
direct allocation
page read and write
5451000
trusted library allocation
page read and write
400000
system
page execute and read and write
114D000
heap
page read and write
6A50000
trusted library allocation
page read and write
5506000
heap
page read and write
5436000
trusted library allocation
page read and write
EB0000
heap
page read and write
40AE000
direct allocation
page read and write
68C0000
trusted library allocation
page execute and read and write
30D1000
trusted library allocation
page read and write
2E7D000
trusted library allocation
page read and write
403D000
direct allocation
page read and write
3079000
trusted library allocation
page read and write
403D000
direct allocation
page read and write
4039000
direct allocation
page read and write
166B000
heap
page read and write
3D70000
direct allocation
page read and write
6930000
trusted library allocation
page execute and read and write
166C000
heap
page read and write
4E08000
trusted library allocation
page read and write
3EAE000
trusted library allocation
page read and write
3F10000
direct allocation
page read and write
41AA000
trusted library allocation
page read and write
6BB4000
trusted library allocation
page read and write
2A43000
trusted library allocation
page read and write
568E000
trusted library allocation
page read and write
1093000
trusted library allocation
page execute and read and write
2A62000
trusted library allocation
page read and write
412A000
trusted library allocation
page read and write
1080000
heap
page read and write
2A67000
trusted library allocation
page execute and read and write
3E93000
direct allocation
page read and write
10DD000
heap
page read and write
6DA6000
trusted library allocation
page read and write
15DA000
heap
page read and write
3F10000
direct allocation
page read and write
17BF000
heap
page read and write
4039000
direct allocation
page read and write
There are 320 hidden memdumps, click here to show them.