IOC Report
(STC) Tax Invoice 25030216_REV.exe

loading gifFilesProcessesURLsDomainsIPsRegistryMemdumps4321010010Label

Files

File Path
Type
Category
Malicious
Download
(STC) Tax Invoice 25030216_REV.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\Melber
data
dropped
C:\Users\user\AppData\Local\Temp\aut7810.tmp
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\(STC) Tax Invoice 25030216_REV.exe
"C:\Users\user\Desktop\(STC) Tax Invoice 25030216_REV.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\(STC) Tax Invoice 25030216_REV.exe"
 malicious

URLs

Name
IP
Malicious
https://www.office.com/
unknown
https://duckduckgo.com/ac/?q=
unknown
https://api.telegram.org
unknown
https://api.telegram.org/bot
unknown
https://duckduckgo.com/chrome_newtabv20-
unknown
https://www.office.com/lB
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:305090%0D%0ADate%20a
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://ac.ecosia.org?q=
unknown
https://api.telegram.org/bot7332888932:AAEd0xO46FUg-eZu8OorYiVnZ_y4D9P2pCE/sendDocument?chat_id=7128988401&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0ACookies%20%7C%20user%20%7C%20VIP%20Recovery
149.154.167.220
http://checkip.dyndns.org
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://chrome.google.com/webstore?hl=en4
unknown
https://reallyfreegeoip.org/xml/45.92.229.138$
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=
unknown
https://chrome.google.com/webstore?hl=en
unknown
https://chrome.google.com/webstore?hl=en8
unknown
http://varders.kozow.com:8081
unknown
http://aborters.duckdns.org:8081
unknown
https://www.google.com/images/branding/product/ico/googleg_alldp.ico
unknown
https://www.office.com/8
unknown
https://www.ecosia.org/newtab/v20
unknown
http://checkip.dyndns.org/
158.101.44.242
https://www.office.com/4
unknown
http://51.38.247.67:8081/_send_.php?L
unknown
http://anotherarmy.dns.army:8081
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:305090%0D%0ADate%20and%20Time:%2029/03/2025%20/%2014:12:19%0D%0ACountry%20Name:%20United%20States%0D%0A[%20305090%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20]
149.154.167.220
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://checkip.dyndns.org/q
unknown
https://chrome.google.com/webstore?hl=enlB
unknown
https://reallyfreegeoip.org
unknown
https://api.telegram.org/bot7332888932:AAEd0xO46FUg-eZu8OorYiVnZ_y4D9P2pCE/sendDocument?chat_id=7128
unknown
https://reallyfreegeoip.org/xml/45.92.229.138
104.21.112.1
http://api.telegram.orgd
unknown
http://api.telegram.org
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://gemini.google.com/app?q=
unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 30 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
104.21.112.1
api.telegram.org
149.154.167.220
checkip.dyndns.com
158.101.44.242
checkip.dyndns.org
unknown

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
104.21.112.1
reallyfreegeoip.org
United States
158.101.44.242
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
2B1A000
trusted library allocation
page read and write
 malicious
3830000
direct allocation
page read and write
 malicious
402000
system
page execute and read and write
 malicious
2931000
trusted library allocation
page read and write
 malicious
16B3000
heap
page read and write
2AE4000
trusted library allocation
page read and write
AE5000
heap
page read and write
3C17000
trusted library allocation
page read and write
26F0000
trusted library allocation
page read and write
EDE000
unkown
page read and write
64C4000
trusted library allocation
page read and write
16B3000
heap
page read and write
2B92000
trusted library allocation
page read and write
3B84000
trusted library allocation
page read and write
276E000
stack
page read and write
4019000
direct allocation
page read and write
2B89000
trusted library allocation
page read and write
3D36000
trusted library allocation
page read and write
AE7000
heap
page read and write
3EC3000
direct allocation
page read and write
1653000
heap
page read and write
16B3000
heap
page read and write
1420000
heap
page read and write
2C75000
trusted library allocation
page read and write
2B7E000
trusted library allocation
page read and write
ED4000
unkown
page readonly
3BFA000
trusted library allocation
page read and write
1654000
heap
page read and write
3890000
heap
page read and write
3C64000
trusted library allocation
page read and write
2702000
trusted library allocation
page read and write
1682000
heap
page read and write
E21000
unkown
page execute read
408E000
direct allocation
page read and write
4E50000
heap
page read and write
63E0000
trusted library allocation
page execute and read and write
3F40000
direct allocation
page read and write
4E16000
trusted library allocation
page read and write
2705000
trusted library allocation
page execute and read and write
27D0000
heap
page execute and read and write
3DA0000
direct allocation
page read and write
3C00000
trusted library allocation
page read and write
2AB9000
trusted library allocation
page read and write
4ED0000
heap
page execute and read and write
1E1E000
stack
page read and write
2B2E000
trusted library allocation
page read and write
D80000
heap
page read and write
29A6000
trusted library allocation
page read and write
16D3000
heap
page read and write
2C9D000
trusted library allocation
page read and write
12EE000
stack
page read and write
1644000
heap
page read and write
2C6C000
trusted library allocation
page read and write
16B3000
heap
page read and write
6460000
trusted library allocation
page read and write
29DC000
trusted library allocation
page read and write
3999000
trusted library allocation
page read and write
2C79000
trusted library allocation
page read and write
2AEA000
trusted library allocation
page read and write
6520000
trusted library allocation
page execute and read and write
270B000
trusted library allocation
page execute and read and write
F30000
heap
page read and write
40DE000
direct allocation
page read and write
178E000
heap
page read and write
3D0E000
trusted library allocation
page read and write
2AB3000
trusted library allocation
page read and write
6880000
heap
page read and write
176E000
heap
page read and write
3C57000
trusted library allocation
page read and write
297F000
trusted library allocation
page read and write
EE2000
unkown
page write copy
2BA5000
trusted library allocation
page read and write
27AC000
stack
page read and write
167C000
heap
page read and write
EAF000
unkown
page readonly
F20000
trusted library allocation
page read and write
B9E000
heap
page read and write
16B4000
heap
page read and write
166D000
heap
page read and write
63F0000
trusted library allocation
page execute and read and write
EE7000
unkown
page readonly
2920000
heap
page read and write
53E0000
trusted library allocation
page execute and read and write
2BA0000
trusted library allocation
page read and write
1660000
heap
page execute and read and write
4E1B000
trusted library allocation
page read and write
2997000
trusted library allocation
page read and write
5F3E000
stack
page read and write
3959000
trusted library allocation
page read and write
1450000
heap
page read and write
2720000
trusted library allocation
page read and write
D7E000
stack
page read and write
E21000
unkown
page execute read
2910000
trusted library allocation
page read and write
4FA0000
heap
page read and write
EE7000
unkown
page readonly
4E2A000
trusted library allocation
page read and write
3C1E000
trusted library allocation
page read and write
64F0000
trusted library allocation
page read and write
26ED000
trusted library allocation
page execute and read and write
446000
system
page execute and read and write
2C6E000
trusted library allocation
page read and write
3A42000
trusted library allocation
page read and write
3AD2000
trusted library allocation
page read and write
2A35000
trusted library allocation
page read and write
3B99000
trusted library allocation
page read and write
B50000
heap
page read and write
5F83000
heap
page read and write
5FBD000
heap
page read and write
2BD8000
trusted library allocation
page read and write
3BB1000
trusted library allocation
page read and write
2C43000
trusted library allocation
page read and write
4019000
direct allocation
page read and write
39AE000
trusted library allocation
page read and write
4EE6000
trusted library allocation
page read and write
3D60000
trusted library allocation
page read and write
4938000
trusted library allocation
page read and write
40DE000
direct allocation
page read and write
3DA0000
direct allocation
page read and write
4069000
direct allocation
page read and write
2B82000
trusted library allocation
page read and write
16B3000
heap
page read and write
3B3A000
trusted library allocation
page read and write
E20000
unkown
page readonly
3997000
trusted library allocation
page read and write
29A2000
trusted library allocation
page read and write
3C28000
trusted library allocation
page read and write
4E3D000
trusted library allocation
page read and write
1628000
heap
page read and write
4EF0000
trusted library allocation
page read and write
3E73000
direct allocation
page read and write
5E3E000
stack
page read and write
408E000
direct allocation
page read and write
298C000
trusted library allocation
page read and write
3F40000
direct allocation
page read and write
3C41000
trusted library allocation
page read and write
165B000
heap
page read and write
2C36000
trusted library allocation
page read and write
3C0C000
trusted library allocation
page read and write
39C8000
trusted library allocation
page read and write
3BAB000
trusted library allocation
page read and write
3EC3000
direct allocation
page read and write
DCE000
stack
page read and write
130B000
stack
page read and write
2AEF000
trusted library allocation
page read and write
16B3000
heap
page read and write
4EC0000
trusted library allocation
page read and write
6480000
trusted library allocation
page execute and read and write
40DE000
direct allocation
page read and write
A55000
heap
page read and write
3B68000
trusted library allocation
page read and write
AB0000
heap
page read and write
61FE000
stack
page read and write
406D000
direct allocation
page read and write
2AB1000
trusted library allocation
page read and write
2AE2000
trusted library allocation
page read and write
26E0000
trusted library allocation
page read and write
400000
system
page execute and read and write
3A2C000
trusted library allocation
page read and write
1652000
heap
page read and write
17AE000
heap
page read and write
BE0000
heap
page read and write
29E8000
trusted library allocation
page read and write
60BE000
stack
page read and write
29D8000
trusted library allocation
page read and write
4EEA000
trusted library allocation
page read and write
DE0000
heap
page read and write
4E10000
trusted library allocation
page read and write
F10000
trusted library allocation
page read and write
401D000
direct allocation
page read and write
176F000
heap
page read and write
3931000
trusted library allocation
page read and write
6400000
trusted library allocation
page execute and read and write
4019000
direct allocation
page read and write
2BCC000
trusted library allocation
page read and write
63BE000
stack
page read and write
3EF0000
direct allocation
page read and write
28DF000
stack
page read and write
4E53000
heap
page read and write
1667000
heap
page read and write
2ABE000
trusted library allocation
page read and write
F2D000
trusted library allocation
page execute and read and write
176E000
heap
page read and write
521E000
stack
page read and write
3B64000
trusted library allocation
page read and write
1667000
heap
page execute and read and write
29F0000
trusted library allocation
page read and write
2A15000
trusted library allocation
page read and write
1620000
heap
page read and write
63C0000
trusted library allocation
page read and write
3A5E000
trusted library allocation
page read and write
3D50000
direct allocation
page read and write
6E9000
stack
page read and write
3C33000
trusted library allocation
page read and write
3C4C000
trusted library allocation
page read and write
1668000
heap
page read and write
6496000
trusted library allocation
page read and write
64D2000
trusted library allocation
page read and write
B68000
heap
page read and write
E2E000
stack
page read and write
2B40000
trusted library allocation
page read and write
2C31000
trusted library allocation
page read and write
A50000
heap
page read and write
3D50000
direct allocation
page read and write
408E000
direct allocation
page read and write
2C70000
trusted library allocation
page read and write
60FE000
stack
page read and write
2900000
trusted library allocation
page read and write
406D000
direct allocation
page read and write
2AAB000
trusted library allocation
page read and write
12FE000
stack
page read and write
62BE000
stack
page read and write
4E36000
trusted library allocation
page read and write
3EC3000
direct allocation
page read and write
EDE000
unkown
page write copy
29E4000
trusted library allocation
page read and write
2700000
trusted library allocation
page read and write
4E42000
trusted library allocation
page read and write
BDD000
stack
page read and write
2AE0000
trusted library allocation
page read and write
AEA000
stack
page read and write
29EC000
trusted library allocation
page read and write
5F40000
heap
page read and write
16B3000
heap
page read and write
3D23000
trusted library allocation
page read and write
176E000
heap
page read and write
3E73000
direct allocation
page read and write
6510000
trusted library allocation
page read and write
406D000
direct allocation
page read and write
4E2E000
trusted library allocation
page read and write
ED4000
unkown
page readonly
4069000
direct allocation
page read and write
E20000
unkown
page readonly
17AE000
heap
page read and write
3D64000
trusted library allocation
page read and write
64D0000
trusted library allocation
page read and write
4ACE000
stack
page read and write
B9D000
stack
page read and write
27B0000
trusted library allocation
page execute and read and write
2A19000
trusted library allocation
page read and write
2C3E000
trusted library allocation
page read and write
2707000
trusted library allocation
page execute and read and write
3DA0000
direct allocation
page read and write
3A8A000
trusted library allocation
page read and write
5FAF000
heap
page read and write
4E31000
trusted library allocation
page read and write
7E7000
stack
page read and write
28E0000
heap
page read and write
26F2000
trusted library allocation
page read and write
A60000
heap
page read and write
5FCF000
heap
page read and write
132C000
stack
page read and write
2C09000
trusted library allocation
page read and write
176E000
heap
page read and write
3EF0000
direct allocation
page read and write
64F7000
trusted library allocation
page read and write
EAF000
unkown
page readonly
1661000
heap
page read and write
53F0000
trusted library allocation
page read and write
531E000
stack
page read and write
2A37000
trusted library allocation
page read and write
4069000
direct allocation
page read and write
2C2C000
trusted library allocation
page read and write
4EE4000
trusted library allocation
page read and write
29AA000
trusted library allocation
page read and write
F23000
trusted library allocation
page execute and read and write
1440000
heap
page read and write
3C90000
trusted library allocation
page read and write
3E73000
direct allocation
page read and write
AAE000
stack
page read and write
3F40000
direct allocation
page read and write
401D000
direct allocation
page read and write
AB8000
heap
page read and write
F24000
trusted library allocation
page read and write
26FA000
trusted library allocation
page execute and read and write
4E60000
trusted library allocation
page read and write
4EFD000
trusted library allocation
page read and write
3EF0000
direct allocation
page read and write
4E1E000
trusted library allocation
page read and write
2C3C000
trusted library allocation
page read and write
6500000
trusted library allocation
page read and write
6464000
trusted library allocation
page read and write
2BC6000
trusted library allocation
page read and write
5400000
trusted library allocation
page execute and read and write
6470000
trusted library allocation
page read and write
2C66000
trusted library allocation
page read and write
221E000
stack
page read and write
27C0000
trusted library allocation
page read and write
3C05000
trusted library allocation
page read and write
5F69000
heap
page read and write
401D000
direct allocation
page read and write
ADA000
heap
page read and write
2B9C000
trusted library allocation
page read and write
64D5000
trusted library allocation
page read and write
3ABC000
trusted library allocation
page read and write
176E000
heap
page read and write
2BD2000
trusted library allocation
page read and write
64E0000
trusted library allocation
page read and write
29E0000
trusted library allocation
page read and write
2AAF000
trusted library allocation
page read and write
3D50000
direct allocation
page read and write
3C12000
trusted library allocation
page read and write
607D000
stack
page read and write
26F6000
trusted library allocation
page execute and read and write
6550000
heap
page read and write
63D0000
trusted library allocation
page execute and read and write
2ADC000
trusted library allocation
page read and write
3894000
heap
page read and write
There are 298 hidden memdumps, click here to show them.