Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

MX-6240N_20241120_124324.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	6.618966075504826
Filename:	MX-6240N_20241120_124324.exe
Filesize:	1228800
MD5:	6f25d9983d50a944a1821f2eb9b1eec7
SHA1:	e05483b06f7bb9401c9b2b7f707d33607e7ece7e
SHA256:	ca8b529cb0b693f6ff0dfe104fd063c4c161c572980dacd2d6d714a84dcfb03e
SHA512:	a3530347da2c3990e604644b4ad8a732f7dda9bda99c95f2d0ec00d2c1a5d9122d972efa2ba7e731e740f76173a561a1c47349ce7bedf9ae7b50b777cb14ed66
SSDEEP:	24576:otb20pkaCqT5TBWgNQ7asjTZxNSz33CF6A:xVg5tQ7asjTZx8W5
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Binary is likely a compiled AutoIt script file	System Summary
Contains functionality to log keystrokes (.Net Source)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion
Switches to a custom stack to bypass stack traces	Malware Analysis System Evasion	System Information Discovery
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to block mouse and keyboard input (often used to hinder debugging)	Anti Debugging
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)	Anti Debugging
Contains functionality to check if a window is minimized (may be used to check if an application is visible)	Hooking and other Techniques for Hiding and Protection
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion	Valid Accounts Access Token Manipulation
Contains functionality to launch a process as a different user	System Summary
Contains functionality to launch a program with higher privileges	HIPS / PFW / Operating System Protection Evasion	Exploitation for Privilege Escalation
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Process Discovery
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to read the PEB	Anti Debugging
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	System Shutdown/Reboot
Contains functionality to simulate keystroke presses	HIPS / PFW / Operating System Protection Evasion
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Detected potential crypto function	System Summary	System Time Discovery Process Discovery Encrypted Channel
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found evaded block containing many API calls	Malware Analysis System Evasion	Process Discovery
Found evasive API chain (date check)	Malware Analysis System Evasion	Native API
Found large amount of non-executed APIs	Malware Analysis System Evasion	System Time Discovery
Found potential string decryption / allocating functions	System Summary
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information	System Shutdown/Reboot
Sample file is different than original file name gathered from version info	System Summary	System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Yara signature match	System Summary
.NET source code contains calls to encryption/decryption functions	System Summary	Disable or Modify Tools Deobfuscate/Decode Files or Information Archive Collected Data
Contains functionality for error logging	System Summary
Contains functionality to add an ACL to a security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary
Contains functionality to check free disk space	System Summary
Contains functionality to create a new security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to instantiate COM classes	System Summary
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to query local / system time	Language, Device and Operating System Detection
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion
PE file has an executable .text section and no other executable section	System Summary
Program exit points	Malware Analysis System Evasion
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
PE file contains a valid data directory to section mapping	System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\Aaberg

data

modified

Details

File:	C:\Users\user\AppData\Local\Temp\Aaberg
Category:	modified
Dump:	Aaberg.0.dr
ID:	dr_1
Target ID:	0
Process:	C:\Users\user\Desktop\MX-6240N_20241120_124324.exe
Type:	data
Entropy:	6.541468216945984
Encrypted:	false
Ssdeep:	6144:gy8nqMr3lXcsAQxlHDgVgrj+JTiuALWTtdGW82np4fzyqmgF:ByYfBtdi2EeqmK
Size:	240128
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\aut2B0F.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\aut2B0F.tmp
Category:	dropped
Dump:	aut2B0F.tmp.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\MX-6240N_20241120_124324.exe
Type:	data
Entropy:	7.878920381160145
Encrypted:	false
Ssdeep:	3072:WOGRBe8QM5hf947yL6QSenV/kTsD9xHFk/oj4n3PST/tNBOiRoFlJFhfjz:SBIM5D5LBSenfD9xl1jw3Ytu1/Bz
Size:	140906
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\MX-6240N_20241120_124324.exe

"C:\Users\user\Desktop\MX-6240N_20241120_124324.exe"

Details

Is windows:	false
Is dropped:	false
PID:	4348
Target ID:	0
Parent PID:	4056
Name:	MX-6240N_20241120_124324.exe
Path:	C:\Users\user\Desktop\MX-6240N_20241120_124324.exe
Commandline:	"C:\Users\user\Desktop\MX-6240N_20241120_124324.exe"
Size:	1228800
MD5:	6F25D9983D50A944A1821F2EB9B1EEC7
Time:	08:03:06
Date:	20/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x2f0000
Modulesize:	1253376
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Binary is likely a compiled AutoIt script file	System Summary
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\user\Desktop\MX-6240N_20241120_124324.exe"

Details

Is windows:	true
Is dropped:	false
PID:	880
Target ID:	6
Parent PID:	4348
Name:	RegSvcs.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Commandline:	"C:\Users\user\Desktop\MX-6240N_20241120_124324.exe"
Size:	45984
MD5:	9D352BC46709F0CB5EC974633A0C3C94
Time:	08:03:07
Date:	20/11/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x180000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://r10.o.lencr.org0#

unknown

Details

Name:	http://r10.o.lencr.org0#
TargetID:	6
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000006.00000002.2529230665.000000000254E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2527825335.0000000000722000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2531273111.00000000059E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2528213455.0000000000790000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2527825335.00000000006E7000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://account.dyn.com/

unknown

Details

Name:	https://account.dyn.com/
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\MX-6240N_20241120_124324.exe
Source:	MX-6240N_20241120_124324.exe, 00000000.00000002.1286430768.0000000003290000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2527426389.0000000000552000.00000040.80000000.00040000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://x1.c.lencr.org/0

unknown

Details

Name:	http://x1.c.lencr.org/0
TargetID:	6
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000006.00000002.2529230665.000000000254E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2527825335.0000000000722000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2531273111.00000000059E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2527825335.00000000006E7000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://x1.i.lencr.org/0

unknown

Details

Name:	http://x1.i.lencr.org/0
TargetID:	6
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000006.00000002.2529230665.000000000254E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2527825335.0000000000722000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2531273111.00000000059E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2527825335.00000000006E7000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://bezelety.top

unknown

http://r10.i.lencr.org/0

unknown

Details

Name:	http://r10.i.lencr.org/0
TargetID:	6
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000006.00000002.2529230665.000000000254E000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2527825335.0000000000722000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2531273111.00000000059E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2528213455.0000000000790000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000006.00000002.2527825335.00000000006E7000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

bezelety.top

194.36.191.196

Details

Name:	bezelety.top
IP:	194.36.191.196
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

194.36.191.196

bezelety.top

Netherlands

Details

IP:	194.36.191.196
TargetID:	6
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	60117
ASN name:	HSAE
Private:	false
Domain:	bezelety.top

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol

Memdumps

Base Address

Regiontype

Protect

Malicious

254E000

trusted library allocation

page read and write

3290000

direct allocation

page read and write

552000

system

page execute and read and write

2501000

trusted library allocation

page read and write

2578000

trusted library allocation

page read and write

6260000

heap

page read and write

2574000

trusted library allocation

page read and write

101A000

heap

page read and write

E09000

heap

page read and write

A50000

heap

page read and write

9BD000

trusted library allocation

page execute and read and write

3A1D000

direct allocation

page read and write

9D6000

trusted library allocation

page execute and read and write

4B33000

heap

page read and write

722000

heap

page read and write

E38000

heap

page read and write

101A000

heap

page read and write

590D000

stack

page read and write

3529000

trusted library allocation

page read and write

101A000

heap

page read and write

DCE000

heap

page read and write

49E0000

heap

page read and write

9E7000

trusted library allocation

page execute and read and write

101A000

heap

page read and write

73C70000

unkown

page readonly

9CD000

trusted library allocation

page execute and read and write

2F0000

unkown

page readonly

73A000

heap

page read and write

73C8F000

unkown

page readonly

3AA000

unkown

page read and write

59AF000

stack

page read and write

52B8000

trusted library allocation

page read and write

43A000

stack

page read and write

2580000

trusted library allocation

page read and write

DEC000

heap

page read and write

59D0000

heap

page read and write

4D0E000

stack

page read and write

5910000

trusted library allocation

page execute and read and write

3A8E000

direct allocation

page read and write

9B3000

trusted library allocation

page execute and read and write

624F000

stack

page read and write

3A19000

direct allocation

page read and write

73C8D000

unkown

page read and write

101A000

heap

page read and write

2380000

trusted library allocation

page read and write

6270000

trusted library allocation

page execute and read and write

37D000

unkown

page readonly

2F1000

unkown

page execute read

3B4000

unkown

page readonly

19BE000

stack

page read and write

3A8E000

direct allocation

page read and write

24BA000

trusted library allocation

page read and write

6B0000

heap

page read and write

BCF000

stack

page read and write

3AA000

unkown

page write copy

4CCE000

stack

page read and write

59E0000

heap

page read and write

614E000

stack

page read and write

E07000

heap

page read and write

EFA000

heap

page read and write

620000

heap

page read and write

58B6000

trusted library allocation

page read and write

233C000

stack

page read and write

57D000

stack

page read and write

59D6000

heap

page read and write

9B0000

trusted library allocation

page read and write

3A1D000

direct allocation

page read and write

635000

heap

page read and write

EB3000

heap

page read and write

3A1D000

direct allocation

page read and write

101A000

heap

page read and write

EFA000

heap

page read and write

5A34000

heap

page read and write

5D0D000

stack

page read and write

FC6000

heap

page read and write

3750000

direct allocation

page read and write

3E3000

unkown

page readonly

9EB000

trusted library allocation

page execute and read and write

73C86000

unkown

page readonly

5BE000

stack

page read and write

4B9000

stack

page read and write

2567000

trusted library allocation

page read and write

9B4000

trusted library allocation

page read and write

24A6000

trusted library allocation

page read and write

5890000

trusted library allocation

page read and write

5A4A000

heap

page read and write

E28000

heap

page read and write

E09000

heap

page read and write

3A1D000

direct allocation

page read and write

101A000

heap

page read and write

DC0000

heap

page read and write

469D000

stack

page read and write

58C0000

trusted library allocation

page execute and read and write

BDB000

stack

page read and write

3A8E000

direct allocation

page read and write

2370000

trusted library allocation

page read and write

356B000

trusted library allocation

page read and write

3400000

heap

page read and write

3750000

direct allocation

page read and write

24AB000

trusted library allocation

page read and write

4F2E000

stack

page read and write

249E000

stack

page read and write

DFC000

heap

page read and write

5B50000

trusted library allocation

page read and write

59B0000

trusted library allocation

page read and write

37D000

unkown

page readonly

FC9000

heap

page read and write

2390000

heap

page execute and read and write

101A000

heap

page read and write

9E5000

trusted library allocation

page execute and read and write

790000

heap

page read and write

39E000

unkown

page readonly

58B0000

trusted library allocation

page read and write

630000

heap

page read and write

4508000

trusted library allocation

page read and write

6B8000

heap

page read and write

24F0000

heap

page read and write

589C000

trusted library allocation

page read and write

FC9000

heap

page read and write

530000

heap

page read and write

9DA000

trusted library allocation

page execute and read and write

3A1D000

direct allocation

page read and write

3A19000

direct allocation

page read and write

4B1C000

stack

page read and write

4C3C000

stack

page read and write

A00000

trusted library allocation

page read and write

101A000

heap

page read and write

73C71000

unkown

page execute read

FC6000

heap

page read and write

59C0000

trusted library allocation

page read and write

550000

system

page execute and read and write

52B0000

trusted library allocation

page read and write

24A0000

trusted library allocation

page read and write

5F0000

heap

page read and write

76F000

heap

page read and write

4C8E000

stack

page read and write

3873000

direct allocation

page read and write

38F0000

direct allocation

page read and write

24CD000

trusted library allocation

page read and write

2F1000

unkown

page execute read

5C0000

heap

page read and write

101A000

heap

page read and write

2340000

trusted library allocation

page execute and read and write

3A8E000

direct allocation

page read and write

24C1000

trusted library allocation

page read and write

6DA000

heap

page read and write

D80000

heap

page read and write

3A8E000

direct allocation

page read and write

3873000

direct allocation

page read and write

3A8E000

direct allocation

page read and write

3E3000

unkown

page readonly

4E2E000

stack

page read and write

38F0000

direct allocation

page read and write

3750000

direct allocation

page read and write

BFC000

stack

page read and write

3A19000

direct allocation

page read and write

9D0000

trusted library allocation

page read and write

3873000

direct allocation

page read and write

2F0000

unkown

page readonly

3A19000

direct allocation

page read and write

502F000

stack

page read and write

3750000

direct allocation

page read and write

58A0000

trusted library allocation

page read and write

24C6000

trusted library allocation

page read and write

3404000

heap

page read and write

59D2000

heap

page read and write

3A19000

direct allocation

page read and write

254C000

trusted library allocation

page read and write

9A0000

trusted library allocation

page read and write

38F0000

direct allocation

page read and write

690000

heap

page read and write

EFA000

heap

page read and write

E93000

heap

page read and write

FC6000

heap

page read and write

101A000

heap

page read and write

A4E000

stack

page read and write

E09000

heap

page read and write

24D2000

trusted library allocation

page read and write

3A19000

direct allocation

page read and write

38F0000

direct allocation

page read and write

2360000

trusted library allocation

page read and write

24B2000

trusted library allocation

page read and write

38F0000

direct allocation

page read and write

9C0000

trusted library allocation

page read and write

4D20000

heap

page execute and read and write

E2D000

heap

page read and write

5B0D000

stack

page read and write

39E000

unkown

page readonly

3B4000

unkown

page readonly

3873000

direct allocation

page read and write

3A8E000

direct allocation

page read and write

3501000

trusted library allocation

page read and write

9D2000

trusted library allocation

page read and write

7FB20000

trusted library allocation

page execute and read and write

59B7000

trusted library allocation

page read and write

DCA000

heap

page read and write

FC5000

heap

page execute and read and write

4B30000

heap

page read and write

3A1D000

direct allocation

page read and write

785000

heap

page read and write

3750000

direct allocation

page read and write

6E5000

heap

page read and write

5D0000

heap

page read and write

15BE000

stack

page read and write

3873000

direct allocation

page read and write

24AE000

trusted library allocation

page read and write

3A19000

direct allocation

page read and write

38F0000

direct allocation

page read and write

3AF000

unkown

page write copy

101A000

heap

page read and write

E94000

heap

page read and write

3A1D000

direct allocation

page read and write

9E2000

trusted library allocation

page read and write

3750000

direct allocation

page read and write

101A000

heap

page read and write

101A000

heap

page read and write

FCB000

heap

page read and write

24BE000

trusted library allocation

page read and write

3873000

direct allocation

page read and write

3750000

direct allocation

page read and write

6E7000

heap

page read and write

38F0000

direct allocation

page read and write

6280000

heap

page read and write

101A000

heap

page read and write

100B000

heap

page read and write

BBC000

stack

page read and write

1AE0000

heap

page read and write

101A000

heap

page read and write

E93000

heap

page read and write

538000

stack

page read and write

3873000

direct allocation

page read and write

520000

heap

page read and write

2350000

trusted library allocation

page read and write

There are 223 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
MX-6240N_20241120_124324.exe

Files

Processes

URLs

Domains

IPs

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportMX-6240N_20241120_124324.exe

Files

Processes

URLs

Domains

IPs

Memdumps

IOC Report
MX-6240N_20241120_124324.exe