IOC Report
Order Specifications for Materials.docx.exe

loading gifFilesProcessesURLsDomainsIPsRegistryMemdumps54321010010Label

Files

File Path
Type
Category
Malicious
Download
Order Specifications for Materials.docx.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
modified
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\sgxIb.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Local\Temp\Roca
data
dropped
C:\Users\user\AppData\Local\Temp\aut3634.tmp
data
dropped
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Order Specifications for Materials.docx.exe
"C:\Users\user\Desktop\Order Specifications for Materials.docx.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\Order Specifications for Materials.docx.exe"
 malicious
C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
malicious
C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe
"C:\Users\user\AppData\Roaming\sgxIb\sgxIb.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.13.205
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
http://ftp.haliza.com.my
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

Domains

Name
IP
Malicious
api.ipify.org
104.26.13.205
ftp.haliza.com.my
110.4.45.197

IPs

IP
Domain
Country
Malicious
110.4.45.197
ftp.haliza.com.my
Malaysia
104.26.13.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
sgxIb
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
29DF000
heap
page read and write
 malicious
3DC1000
trusted library allocation
page read and write
 malicious
54D0000
trusted library section
page read and write
 malicious
52D0000
trusted library section
page read and write
 malicious
2E14000
trusted library allocation
page read and write
 malicious
12EB000
trusted library allocation
page execute and read and write
15C7000
trusted library allocation
page execute and read and write
F5C000
heap
page read and write
5212000
trusted library allocation
page read and write
E90000
trusted library section
page read and write
15F0000
heap
page read and write
38D0000
direct allocation
page read and write
156E000
stack
page read and write
FCF000
heap
page read and write
D4B000
stack
page read and write
39F9000
direct allocation
page read and write
F0B000
trusted library allocation
page execute and read and write
F48000
heap
page read and write
6810000
trusted library allocation
page read and write
F02000
trusted library allocation
page read and write
99A000
stack
page read and write
725D000
stack
page read and write
2C70000
heap
page execute and read and write
1195000
heap
page read and write
7117000
heap
page read and write
F23000
heap
page read and write
1350000
heap
page read and write
33C0000
direct allocation
page read and write
6BE0000
trusted library allocation
page read and write
1AAE000
stack
page read and write
E7C000
stack
page read and write
591E000
stack
page read and write
2D3C000
stack
page read and write
5920000
heap
page read and write
4091000
trusted library allocation
page read and write
56FE000
stack
page read and write
2D60000
heap
page execute and read and write
5AB0000
trusted library allocation
page execute and read and write
F7F000
heap
page read and write
70CC000
stack
page read and write
BCF000
stack
page read and write
168C000
stack
page read and write
3E6F000
trusted library allocation
page read and write
2DC1000
trusted library allocation
page read and write
53C0000
trusted library allocation
page read and write
BEA000
unkown
page readonly
1A4000
unkown
page readonly
3B99000
direct allocation
page read and write
F1000
unkown
page execute read
EB8000
heap
page read and write
1AE000
unkown
page read and write
1640000
heap
page execute and read and write
4EBD000
stack
page read and write
6CEC000
heap
page read and write
F7C000
heap
page read and write
11E0000
heap
page read and write
130E000
heap
page read and write
3A70000
direct allocation
page read and write
F5C000
heap
page read and write
12F8000
heap
page read and write
62FB000
stack
page read and write
67E0000
trusted library allocation
page read and write
567E000
stack
page read and write
1230000
heap
page read and write
F5D000
heap
page read and write
53BE000
stack
page read and write
6826000
trusted library allocation
page read and write
F5C000
heap
page read and write
2BC8000
trusted library allocation
page read and write
116A000
stack
page read and write
535C000
stack
page read and write
1AE000
unkown
page write copy
3584000
heap
page read and write
CF8000
stack
page read and write
D60000
heap
page read and write
6804000
trusted library allocation
page read and write
EE2000
heap
page read and write
BDB000
stack
page read and write
F0000
unkown
page readonly
70E0000
heap
page read and write
1218000
heap
page read and write
7260000
trusted library allocation
page read and write
66BE000
stack
page read and write
F4F000
heap
page execute and read and write
15A0000
trusted library allocation
page read and write
2B10000
heap
page read and write
15E0000
trusted library allocation
page read and write
129F000
stack
page read and write
55CE000
stack
page read and write
3EC7000
trusted library allocation
page read and write
15CB000
trusted library allocation
page execute and read and write
EF6000
trusted library allocation
page execute and read and write
3080000
heap
page read and write
EF0000
heap
page read and write
2E10000
trusted library allocation
page read and write
EE0000
trusted library allocation
page read and write
EE6000
heap
page read and write
2C80000
heap
page read and write
5200000
trusted library allocation
page read and write
12B3000
trusted library allocation
page execute and read and write
6BD0000
trusted library allocation
page execute and read and write
12E7000
trusted library allocation
page execute and read and write
2DFA000
trusted library allocation
page read and write
2CB0000
heap
page read and write
571C000
stack
page read and write
E7C000
stack
page read and write
62BC000
stack
page read and write
8160000
heap
page read and write
1248000
heap
page read and write
2AD0000
trusted library allocation
page read and write
12A0000
trusted library allocation
page read and write
5360000
trusted library allocation
page execute and read and write
F23000
heap
page read and write
67F0000
trusted library allocation
page execute and read and write
7FD20000
trusted library allocation
page execute and read and write
522E000
stack
page read and write
691E000
stack
page read and write
39F3000
direct allocation
page read and write
DA0000
heap
page read and write
F85000
heap
page read and write
3B9D000
direct allocation
page read and write
6C3C000
stack
page read and write
61BC000
stack
page read and write
3B99000
direct allocation
page read and write
1B7000
unkown
page readonly
1100000
heap
page read and write
BE2000
unkown
page readonly
F57000
heap
page read and write
38D0000
direct allocation
page read and write
15A4000
trusted library allocation
page read and write
56BE000
stack
page read and write
BFC000
stack
page read and write
3091000
trusted library allocation
page read and write
573C000
heap
page read and write
57EF000
heap
page read and write
BBF000
stack
page read and write
38D0000
direct allocation
page read and write
EF0000
heap
page read and write
F5D000
heap
page read and write
E30000
heap
page read and write
EF2000
trusted library allocation
page read and write
522D000
trusted library allocation
page read and write
F23000
heap
page read and write
6840000
trusted library allocation
page execute and read and write
C00000
heap
page read and write
3A6E000
direct allocation
page read and write
5226000
trusted library allocation
page read and write
111C000
stack
page read and write
10FE000
stack
page read and write
D00000
heap
page read and write
6820000
trusted library allocation
page read and write
1B2000
unkown
page write copy
560E000
stack
page read and write
D1D000
stack
page read and write
6B1C000
stack
page read and write
38D0000
direct allocation
page read and write
EAB000
heap
page read and write
2E67000
trusted library allocation
page read and write
12B4000
trusted library allocation
page read and write
426000
system
page execute and read and write
5610000
trusted library allocation
page execute and read and write
12E0000
trusted library allocation
page read and write
599000
stack
page read and write
2B5E000
stack
page read and write
5570000
trusted library allocation
page read and write
5720000
heap
page read and write
2BB0000
heap
page read and write
2BA0000
trusted library allocation
page read and write
2B9C000
stack
page read and write
EFD000
heap
page read and write
67BE000
stack
page read and write
101F000
heap
page read and write
3580000
heap
page read and write
2D40000
heap
page read and write
520B000
trusted library allocation
page read and write
657D000
stack
page read and write
2E03000
trusted library allocation
page read and write
52C0000
heap
page execute and read and write
1BA0000
direct allocation
page read and write
585E000
stack
page read and write
7110000
heap
page read and write
57D9000
heap
page read and write
3A6E000
direct allocation
page read and write
5232000
trusted library allocation
page read and write
15C0000
trusted library allocation
page read and write
1690000
trusted library allocation
page execute and read and write
2CB7000
heap
page read and write
5380000
trusted library allocation
page read and write
ED4000
trusted library allocation
page read and write
34E3000
direct allocation
page read and write
3B9D000
direct allocation
page read and write
F46000
heap
page read and write
306F000
stack
page read and write
2D70000
heap
page read and write
F45000
heap
page read and write
1313000
heap
page read and write
34E3000
direct allocation
page read and write
1180000
heap
page read and write
6920000
trusted library allocation
page execute and read and write
BE0000
unkown
page readonly
ED3000
trusted library allocation
page execute and read and write
F5C000
heap
page read and write
39F3000
direct allocation
page read and write
FE0000
heap
page read and write
17F000
unkown
page readonly
2CA0000
trusted library allocation
page read and write
F79000
stack
page read and write
2C60000
trusted library allocation
page read and write
D5E000
stack
page read and write
63FD000
stack
page read and write
152E000
stack
page read and write
2AF0000
trusted library allocation
page read and write
3E87000
trusted library allocation
page read and write
3B99000
direct allocation
page read and write
5AA0000
heap
page read and write
32AA000
trusted library allocation
page read and write
EB0000
trusted library section
page read and write
17CF000
stack
page read and write
38D0000
direct allocation
page read and write
581F000
stack
page read and write
1550000
heap
page read and write
39FD000
direct allocation
page read and write
6BC0000
heap
page read and write
F10000
heap
page read and write
5929000
heap
page read and write
EC0000
trusted library allocation
page read and write
135A000
heap
page read and write
EE2000
heap
page read and write
F30000
heap
page read and write
1327000
heap
page read and write
FB2000
heap
page read and write
EDD000
trusted library allocation
page execute and read and write
131A000
heap
page read and write
1210000
heap
page read and write
EB0000
heap
page read and write
12C4000
trusted library allocation
page read and write
521E000
trusted library allocation
page read and write
667E000
stack
page read and write
F44000
heap
page read and write
F1000
unkown
page execute read
6B9E000
stack
page read and write
F5A000
heap
page read and write
5520000
heap
page read and write
53CD000
trusted library allocation
page read and write
F5C000
heap
page read and write
E60000
heap
page read and write
F28000
heap
page read and write
6CE0000
heap
page read and write
D55000
heap
page read and write
F23000
heap
page read and write
3A6E000
direct allocation
page read and write
548E000
stack
page read and write
121C000
stack
page read and write
F44000
heap
page read and write
F44000
heap
page read and write
FCB000
heap
page read and write
520E000
trusted library allocation
page read and write
558E000
stack
page read and write
595F000
stack
page read and write
1500000
trusted library allocation
page read and write
2F1B000
trusted library allocation
page read and write
ED3000
heap
page read and write
39F9000
direct allocation
page read and write
38D0000
direct allocation
page read and write
12BD000
trusted library allocation
page execute and read and write
15AD000
trusted library allocation
page execute and read and write
F05000
trusted library allocation
page execute and read and write
F14000
heap
page read and write
D50000
heap
page read and write
33C0000
direct allocation
page read and write
715B000
stack
page read and write
1A4000
unkown
page readonly
123B000
heap
page read and write
5750000
heap
page execute and read and write
F0000
unkown
page readonly
F50000
heap
page read and write
F56000
heap
page execute and read and write
5610000
heap
page execute and read and write
52A0000
trusted library allocation
page read and write
EED000
trusted library allocation
page execute and read and write
39F3000
direct allocation
page read and write
6A1C000
unkown
page read and write
1580000
trusted library allocation
page read and write
2E7F000
stack
page read and write
6930000
trusted library allocation
page read and write
159D000
trusted library allocation
page execute and read and write
134E000
stack
page read and write
445000
system
page execute and read and write
1594000
trusted library allocation
page read and write
2E81000
trusted library allocation
page read and write
3A70000
direct allocation
page read and write
68DE000
stack
page read and write
EF0000
heap
page read and write
1355000
heap
page read and write
5420000
trusted library allocation
page execute and read and write
39FD000
direct allocation
page read and write
571F000
stack
page read and write
F44000
heap
page read and write
5A30000
heap
page read and write
5762000
heap
page read and write
EF0000
trusted library allocation
page read and write
11D0000
heap
page read and write
114E000
stack
page read and write
1190000
heap
page read and write
39FD000
direct allocation
page read and write
2AE0000
trusted library allocation
page execute and read and write
6800000
trusted library allocation
page read and write
6830000
trusted library allocation
page read and write
3C0E000
direct allocation
page read and write
34E3000
direct allocation
page read and write
3B9D000
direct allocation
page read and write
1C10000
heap
page read and write
12F0000
heap
page read and write
576E000
heap
page read and write
F5C000
heap
page read and write
3C0E000
direct allocation
page read and write
F07000
trusted library allocation
page execute and read and write
FD3000
heap
page read and write
16AE000
stack
page read and write
12CD000
trusted library allocation
page execute and read and write
3A70000
direct allocation
page read and write
501E000
stack
page read and write
1593000
trusted library allocation
page execute and read and write
1235000
heap
page read and write
F20000
heap
page read and write
70D0000
heap
page read and write
6B5E000
stack
page read and write
EE3000
trusted library allocation
page read and write
F5C000
heap
page read and write
5370000
trusted library allocation
page read and write
F46000
heap
page read and write
3E81000
trusted library allocation
page read and write
163E000
stack
page read and write
EE3000
heap
page read and write
106C000
stack
page read and write
EFA000
trusted library allocation
page execute and read and write
EA7000
heap
page read and write
39F9000
direct allocation
page read and write
16C0000
heap
page read and write
EF0000
heap
page read and write
1B7000
unkown
page readonly
54CE000
stack
page read and write
F46000
heap
page read and write
ED0000
trusted library allocation
page read and write
33C0000
direct allocation
page read and write
2DBE000
stack
page read and write
7100000
trusted library allocation
page read and write
5221000
trusted library allocation
page read and write
154E000
stack
page read and write
16A0000
heap
page read and write
F0E000
heap
page read and write
527E000
stack
page read and write
F5C000
heap
page read and write
EA0000
heap
page read and write
5A5F000
stack
page read and write
8170000
heap
page read and write
3217000
trusted library allocation
page read and write
3070000
trusted library allocation
page read and write
67E7000
trusted library allocation
page read and write
12C0000
trusted library allocation
page read and write
14EF000
stack
page read and write
17F000
unkown
page readonly
400000
system
page execute and read and write
3C0E000
direct allocation
page read and write
There are 354 hidden memdumps, click here to show them.