Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

RFQ SN00954666 for prosjekt CMC 40 fot container.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.389083092587591
Filename:	RFQ SN00954666 for prosjekt CMC 40 fot container.exe
Filesize:	1150499
MD5:	6f372aad87d442dec0f25eafa57cd9f5
SHA1:	5cb1f90381f86732a50431e75bf21ee045ddd5a1
SHA256:	b81164598e70459709bba50dead99248d28e6d4dc0e0e5093fa28ad554c9694a
SHA512:	627d8b92939349e48803cfcfa50e4efead10761b5444e6a69661fe37ff760f86683be02362e4706d62e7feaba3a093a207183f587b8f0a9d39ac93076be9b24b
SSDEEP:	24576:ffmMv6Ckr7Mny5QLlYYwMil9A4Zd93j7Vd0044:f3v+7/5QLGYFib93jc07
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary	System Information Discovery
Multi AV Scanner detection for submitted file	AV Detection	Disable or Modify Tools
Contains functionality to detect sleep reduction / modifications	Malware Analysis System Evasion
Contains functionality to log keystrokes (.Net Source)	Key, Mouse, Clipboard, Microphone and Screen Capturing
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Switches to a custom stack to bypass stack traces	Malware Analysis System Evasion	Access Token Manipulation
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to block mouse and keyboard input (often used to hinder debugging)	Anti Debugging	Disable or Modify Tools
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a window is minimized (may be used to check if an application is visible)	Hooking and other Techniques for Hiding and Protection	Application Window Discovery
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion	Valid Accounts Disable or Modify Tools
Contains functionality to launch a process as a different user	System Summary	Native API
Contains functionality to launch a program with higher privileges	HIPS / PFW / Operating System Protection Evasion	Exploitation for Privilege Escalation Access Token Manipulation
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Process Discovery
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection	Disable or Modify Tools
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Disable or Modify Tools
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate keystroke presses	HIPS / PFW / Operating System Protection Evasion
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Creates processes with suspicious names	Persistence and Installation Behavior
Detected potential crypto function	System Summary	Access Token Manipulation System Time Discovery Process Discovery Encrypted Channel
Found large amount of non-executed APIs	Malware Analysis System Evasion	Access Token Manipulation System Time Discovery
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information	Access Token Manipulation Disable or Modify Tools System Shutdown/Reboot
PE file contains an invalid checksum	Data Obfuscation
Potential key logger detected (key state polling based)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Disable or Modify Tools
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Disable or Modify Tools
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Yara signature match	System Summary	Disable or Modify Tools
.NET source code contains calls to encryption/decryption functions	System Summary	Archive Collected Data
Contains functionality for error logging	System Summary	Access Token Manipulation Disable or Modify Tools
Contains functionality to add an ACL to a security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to check free disk space	System Summary
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to instantiate COM classes	System Summary	Access Token Manipulation
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query system information	Malware Analysis System Evasion	System Information Discovery
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Creates temporary files	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion
Might use command line arguments	System Summary	Command and Scripting Interpreter
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation Disable or Modify Tools
Sample reads its own file content	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading Disable or Modify Tools
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
Submission file is bigger than most known malware samples	System Summary	Disable or Modify Tools

C:\Users\user\AppData\Local\Temp\proximobuccal

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\proximobuccal
Category:	dropped
Dump:	proximobuccal.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\RFQ SN00954666 for prosjekt CMC 40 fot container.exe
Type:	data
Entropy:	6.562944983093842
Encrypted:	false
Ssdeep:	6144:n8kkLOst9XwRB3BtG4A/dcIQZ4boydhA5VcJWkCLUmWtINGqaGwfhLKc1OQb2Ax7:nJOVmtPb5Z4bfdhkcB/mWtIkqMhzwQqm
Size:	240128
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\RFQ SN00954666 for prosjekt CMC 40 fot container.exe

"C:\Users\user\Desktop\RFQ SN00954666 for prosjekt CMC 40 fot container.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7468
Target ID:	0
Parent PID:	4084
Name:	RFQ SN00954666 for prosjekt CMC 40 fot container.exe
Path:	C:\Users\user\Desktop\RFQ SN00954666 for prosjekt CMC 40 fot container.exe
Commandline:	"C:\Users\user\Desktop\RFQ SN00954666 for prosjekt CMC 40 fot container.exe"
Size:	1150499
MD5:	6F372AAD87D442DEC0F25EAFA57CD9F5
Time:	05:10:45
Date:	04/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	741376
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Initial sample is a PE file and has a suspicious name	System Summary
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
PE file contains an invalid checksum	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\user\Desktop\RFQ SN00954666 for prosjekt CMC 40 fot container.exe"

Details

Is windows:	true
Is dropped:	false
PID:	7556
Target ID:	2
Parent PID:	7468
Name:	RegSvcs.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Commandline:	"C:\Users\user\Desktop\RFQ SN00954666 for prosjekt CMC 40 fot container.exe"
Size:	45984
MD5:	9D352BC46709F0CB5EC974633A0C3C94
Time:	05:10:47
Date:	04/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xb30000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://bezelety.top

unknown

Details

Name:	http://bezelety.top
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.2675578271.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for domain / URL	AV Detection
URLs found in memory or binary data	Networking

http://r10.o.lencr.org0#

unknown

Details

Name:	http://r10.o.lencr.org0#
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.2675056260.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2677194082.0000000006220000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2674885834.0000000001136000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2675056260.00000000011CE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2675578271.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://account.dyn.com/

unknown

Details

Name:	https://account.dyn.com/
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\RFQ SN00954666 for prosjekt CMC 40 fot container.exe
Source:	RFQ SN00954666 for prosjekt CMC 40 fot container.exe, 00000000.00000002.1439403313.0000000004240000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2674488726.0000000000402000.00000040.80000000.00040000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://x1.c.lencr.org/0

unknown

Details

Name:	http://x1.c.lencr.org/0
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.2675056260.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2677194082.0000000006220000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2674885834.0000000001136000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2675578271.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://x1.i.lencr.org/0

unknown

Details

Name:	http://x1.i.lencr.org/0
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.2675056260.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2677194082.0000000006220000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2674885834.0000000001136000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2675578271.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://r10.i.lencr.org/0

unknown

Details

Name:	http://r10.i.lencr.org/0
TargetID:	2
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000002.00000002.2675056260.00000000011D8000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2677194082.0000000006220000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2674885834.0000000001136000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2675056260.00000000011CE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2675578271.0000000002DFE000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

bezelety.top

194.36.191.196

Details

Name:	bezelety.top
IP:	194.36.191.196
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

194.36.191.196

bezelety.top

Netherlands

Details

IP:	194.36.191.196
TargetID:	2
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	60117
ASN name:	HSAE
Private:	false
Domain:	bezelety.top

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol

Memdumps

Base Address

Regiontype

Protect

Malicious

2DB1000

trusted library allocation

page read and write

2E28000

trusted library allocation

page read and write

402000

system

page execute and read and write

4240000

direct allocation

page read and write

2DFE000

trusted library allocation

page read and write

3E41000

heap

page read and write

4410000

direct allocation

page read and write

3E41000

heap

page read and write

3C40000

heap

page read and write

134E000

stack

page read and write

637D000

stack

page read and write

1430000

heap

page read and write

4410000

direct allocation

page read and write

474E000

direct allocation

page read and write

4533000

direct allocation

page read and write

980000

heap

page read and write

10B3000

trusted library allocation

page execute and read and write

2D10000

heap

page execute and read and write

100000

heap

page read and write

10A0000

trusted library allocation

page read and write

1300000

trusted library allocation

page read and write

3ED2000

heap

page read and write

4533000

direct allocation

page read and write

10DA000

trusted library allocation

page execute and read and write

1420000

trusted library allocation

page read and write

53CC000

stack

page read and write

A85000

heap

page read and write

4AB000

unkown

page readonly

11D8000

heap

page read and write

3E8C000

heap

page read and write

544E000

stack

page read and write

F30000

heap

page read and write

3E8C000

heap

page read and write

8FE000

stack

page read and write

1F6000

heap

page read and write

3E9C000

heap

page read and write

13E0000

trusted library allocation

page execute and read and write

3ED2000

heap

page read and write

3E8C000

heap

page read and write

6460000

trusted library allocation

page read and write

3E8C000

heap

page read and write

46DD000

direct allocation

page read and write

164F000

stack

page read and write

3D8E000

heap

page read and write

2CE0000

trusted library allocation

page read and write

2D3E000

trusted library allocation

page read and write

2D00000

heap

page execute and read and write

A2E000

stack

page read and write

4F4D000

stack

page read and write

45B0000

direct allocation

page read and write

46D9000

direct allocation

page read and write

8AF000

stack

page read and write

3D56000

heap

page read and write

383E000

stack

page read and write

3E8C000

heap

page read and write

5458000

trusted library allocation

page read and write

5450000

trusted library allocation

page read and write

9DE000

stack

page read and write

2CDE000

stack

page read and write

3CF8000

heap

page read and write

3ED2000

heap

page read and write

59BE000

stack

page read and write

89F000

stack

page read and write

1E0000

heap

page read and write

3E8C000

heap

page read and write

10E7000

trusted library allocation

page execute and read and write

2D2B000

trusted library allocation

page read and write

10CD000

trusted library allocation

page execute and read and write

112A000

heap

page read and write

17A0000

heap

page read and write

3E9C000

heap

page read and write

2E18000

trusted library allocation

page read and write

474E000

direct allocation

page read and write

7F8D0000

trusted library allocation

page execute and read and write

490000

unkown

page read and write

10BD000

trusted library allocation

page execute and read and write

3E8C000

heap

page read and write

1F0000

heap

page read and write

3E37000

heap

page read and write

474E000

direct allocation

page read and write

3E8C000

heap

page read and write

424E000

heap

page read and write

30F4000

heap

page read and write

1065000

heap

page read and write

119C000

heap

page read and write

4DB8000

trusted library allocation

page read and write

6326000

trusted library allocation

page read and write

16EB000

heap

page read and write

9A000

stack

page read and write

138C000

stack

page read and write

3E33000

heap

page read and write

3E8C000

heap

page read and write

3EC8000

heap

page read and write

577F000

stack

page read and write

482000

unkown

page readonly

10EB000

trusted library allocation

page execute and read and write

1060000

heap

page read and write

3E17000

trusted library allocation

page read and write

124E000

stack

page read and write

400000

system

page execute and read and write

6EC0000

heap

page read and write

2D20000

trusted library allocation

page read and write

400000

unkown

page readonly

1650000

heap

page read and write

10E0000

trusted library allocation

page read and write

1770000

heap

page read and write

4410000

direct allocation

page read and write

45B0000

direct allocation

page read and write

1100000

heap

page read and write

2E16000

trusted library allocation

page read and write

6220000

heap

page read and write

661D000

stack

page read and write

8B4000

stack

page read and write

6BA0000

trusted library allocation

page read and write

474E000

direct allocation

page read and write

4410000

direct allocation

page read and write

6A5F000

stack

page read and write

4307000

heap

page read and write

950000

heap

page read and write

A82000

heap

page read and write

A5E000

heap

page read and write

1785000

heap

page read and write

401000

unkown

page execute read

1136000

heap

page read and write

46DD000

direct allocation

page read and write

46D9000

direct allocation

page read and write

10C0000

trusted library allocation

page read and write

46D9000

direct allocation

page read and write

4533000

direct allocation

page read and write

3E40000

heap

page execute and read and write

93E000

stack

page read and write

4533000

direct allocation

page read and write

45B0000

direct allocation

page read and write

3ED2000

heap

page read and write

2E30000

trusted library allocation

page read and write

1050000

heap

page read and write

3E8B000

heap

page read and write

490000

unkown

page write copy

6467000

trusted library allocation

page read and write

58BE000

stack

page read and write

10D6000

trusted library allocation

page execute and read and write

3E8C000

heap

page read and write

1390000

heap

page read and write

641E000

stack

page read and write

46D9000

direct allocation

page read and write

482000

unkown

page readonly

2F5F000

heap

page read and write

6380000

trusted library allocation

page execute and read and write

45B0000

direct allocation

page read and write

6330000

trusted library allocation

page execute and read and write

3E8C000

heap

page read and write

11CE000

heap

page read and write

10D2000

trusted library allocation

page read and write

3ED2000

heap

page read and write

3F04000

heap

page read and write

3E41000

heap

page read and write

1134000

heap

page read and write

10B0000

trusted library allocation

page read and write

2CF0000

trusted library allocation

page read and write

5470000

heap

page read and write

3ED2000

heap

page read and write

6320000

trusted library allocation

page read and write

6249000

heap

page read and write

4533000

direct allocation

page read and write

A87000

heap

page read and write

474E000

direct allocation

page read and write

587E000

stack

page read and write

2DA0000

heap

page read and write

3ED2000

heap

page read and write

30F0000

heap

page read and write

5A20000

trusted library allocation

page read and write

546C000

trusted library allocation

page read and write

BCA000

stack

page read and write

2D3A000

trusted library allocation

page read and write

3D19000

heap

page read and write

645E000

stack

page read and write

3E8C000

heap

page read and write

5473000

heap

page read and write

4410000

direct allocation

page read and write

3ED2000

heap

page read and write

4AB000

unkown

page readonly

45B0000

direct allocation

page read and write

2D4D000

trusted library allocation

page read and write

46DD000

direct allocation

page read and write

540E000

stack

page read and write

5480000

heap

page read and write

2DFC000

trusted library allocation

page read and write

567C000

stack

page read and write

1400000

heap

page read and write

46D9000

direct allocation

page read and write

46DD000

direct allocation

page read and write

111E000

heap

page read and write

1780000

heap

page read and write

3D00000

heap

page read and write

1651000

heap

page read and write

6BD0000

heap

page read and write

6BE0000

trusted library allocation

page execute and read and write

695E000

stack

page read and write

6285000

heap

page read and write

3ED2000

heap

page read and write

6470000

trusted library allocation

page read and write

400000

unkown

page readonly

3C3F000

stack

page read and write

10E2000

trusted library allocation

page read and write

3CFB000

heap

page read and write

45B0000

direct allocation

page read and write

46DD000

direct allocation

page read and write

46DD000

direct allocation

page read and write

4533000

direct allocation

page read and write

A5A000

heap

page read and write

3DD9000

trusted library allocation

page read and write

1108000

heap

page read and write

2D41000

trusted library allocation

page read and write

3DB1000

trusted library allocation

page read and write

3ED2000

heap

page read and write

4A7000

unkown

page read and write

2D46000

trusted library allocation

page read and write

A50000

heap

page read and write

10D0000

trusted library allocation

page read and write

2D2E000

trusted library allocation

page read and write

4410000

direct allocation

page read and write

5460000

trusted library allocation

page read and write

3E44000

heap

page read and write

46D9000

direct allocation

page read and write

16CC000

heap

page read and write

2D32000

trusted library allocation

page read and write

3ED2000

heap

page read and write

401000

unkown

page execute read

EF8000

stack

page read and write

10B4000

trusted library allocation

page read and write

13F0000

trusted library allocation

page read and write

626C000

heap

page read and write

2E24000

trusted library allocation

page read and write

474E000

direct allocation

page read and write

10E5000

trusted library allocation

page execute and read and write

There are 225 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
RFQ SN00954666 for prosjekt CMC 40 fot container.exe

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportRFQ SN00954666 for prosjekt CMC 40 fot container.exe

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
RFQ SN00954666 for prosjekt CMC 40 fot container.exe