Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Catalina - Particulars.pdf.scr.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.969919090949514
Filename:	Catalina - Particulars.pdf.scr.exe
Filesize:	671744
MD5:	316329f616d991c23b6718ba353a6b3a
SHA1:	01afaeed5a260c3909b2e14041cee23923c2d6d3
SHA256:	eec4404be651d77865707efa282ec7899a97550ad25351a70a926679f6b34bdf
SHA512:	11b6b1f028d0599c0e331a0f555a8d17535e059e02182408783608cc2591c9743695421c665ffdcc0ac762b4b1ac42922c398aedfa56e69a41b5164a43505480
SSDEEP:	12288:2VV01VtaNZppBYZ7PtuNfBwEExso1I5FSL3G4YTdO:4mVtozp2Z7PMNeEExsj58L24U
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0.."..........zA... ...`....@.. ....................................@................................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
.NET source code contains potential unpacker	Data Obfuscation	Software Packing
Adds a directory exclusion to Windows Defender	HIPS / PFW / Operating System Protection Evasion
Contains functionality to log keystrokes (.Net Source)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
Machine Learning detection for sample	AV Detection
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)	Malware Analysis System Evasion
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)	Stealing of Sensitive Information	Credentials in Registry
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	OS Credential Dumping Data from Local System
Tries to harvest and steal ftp login credentials	Stealing of Sensitive Information
Tries to steal Mail credentials (via file / registry access)	Stealing of Sensitive Information	Email Collection
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary
Enables debug privileges	Anti Debugging
Found inlined nop instructions (likely shell or obfuscated code)	Software Vulnerabilities
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Monitors certain registry keys / values for changes (often done to protect autostart functionality)	Hooking and other Techniques for Hiding and Protection	Query Registry
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)	Malware Analysis System Evasion
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)	Malware Analysis System Evasion	Windows Management Instrumentation Virtualization/Sandbox Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Yara signature match	System Summary
Binary may include packed or encrypted code	Data Obfuscation
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary
.NET source code contains calls to encryption/decryption functions	System Summary	Disable or Modify Tools Deobfuscate/Decode Files or Information Archive Collected Data
.NET source code contains many API calls related to security	System Summary	Disable or Modify Tools
.NET source code contains many randomly named methods	Data Obfuscation	Disable or Modify Tools
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion	Security Software Discovery
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Queries process information (via WMI, Win32_Process)	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
Checks if Microsoft Office is installed	System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Catalina - Particulars.pdf.scr.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Catalina - Particulars.pdf.scr.exe.log
Category:	dropped
Dump:	Catalina - Particulars.pdf.scr.exe.log.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.34331486778365
Encrypted:	false
Ssdeep:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
Size:	1216
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Category:	dropped
Dump:	StartupProfileData-NonInteractive.2.dr
ID:	dr_5
Target ID:	2
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Type:	data
Entropy:	5.357042452875322
Encrypted:	false
Ssdeep:	24:3CytZWSKco4KmBs4RPT6BmFoUvjKTIKo+mZ9t7J0gt/NKIl9r+q:yyjWSU4y4RQmFoULF+mZ9tK8ND3
Size:	1172
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1q2qy225.5mf.psm1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1q2qy225.5mf.psm1
Category:	dropped
Dump:	__PSScriptPolicyTest_1q2qy225.5mf.psm1.2.dr
ID:	dr_2
Target ID:	2
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	high

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c3ffuu2e.sqc.ps1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_c3ffuu2e.sqc.ps1
Category:	dropped
Dump:	__PSScriptPolicyTest_c3ffuu2e.sqc.ps1.2.dr
ID:	dr_3
Target ID:	2
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	high

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rq405u4c.ocl.ps1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rq405u4c.ocl.ps1
Category:	dropped
Dump:	__PSScriptPolicyTest_rq405u4c.ocl.ps1.2.dr
ID:	dr_1
Target ID:	2
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	timeout

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xnf1nayc.yfe.psm1

ASCII text, with no line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xnf1nayc.yfe.psm1
Category:	dropped
Dump:	__PSScriptPolicyTest_xnf1nayc.yfe.psm1.2.dr
ID:	dr_4
Target ID:	2
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Type:	ASCII text, with no line terminators
Entropy:	4.038920595031593
Encrypted:	false
Ssdeep:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
Size:	60
Whitelisted:	false
Reputation:	timeout

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe

"C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6636
Target ID:	0
Parent PID:	2580
Name:	Catalina - Particulars.pdf.scr.exe
Path:	C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe
Commandline:	"C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe"
Size:	671744
MD5:	316329F616D991C23B6718BA353A6B3A
Time:	00:22:54
Date:	29/08/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x260000
Modulesize:	696320
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AntiVM3	Malware Analysis System Evasion
Adds a directory exclusion to Windows Defender	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Initial sample is a PE file and has a suspicious name	System Summary
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet	System Summary
Uses an obfuscated file name to hide its real file extension (double extension)	Hooking and other Techniques for Hiding and Protection	Masquerading Obfuscated Files or Information
Yara detected Generic Downloader	Networking
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: Powershell Defender Exclusion	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe"

Details

Is windows:	true
Is dropped:	false
PID:	2120
Target ID:	2
Parent PID:	6636
Name:	powershell.exe
Class:	powershell
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe"
Size:	433152
MD5:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Time:	00:22:55
Date:	29/08/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x2c0000
Modulesize:	446464
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Adds a directory exclusion to Windows Defender	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet	System Summary
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Powershell Defender Exclusion	System Summary
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection

C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe

"C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe"

Details

Is windows:	false
Is dropped:	false
PID:	8
Target ID:	3
Parent PID:	6636
Name:	Catalina - Particulars.pdf.scr.exe
Path:	C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe
Commandline:	"C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe"
Size:	671744
MD5:	316329F616D991C23B6718BA353A6B3A
Time:	00:22:55
Date:	29/08/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x2d0000
Modulesize:	696320
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AntiVM3	Malware Analysis System Evasion
Adds a directory exclusion to Windows Defender	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Initial sample is a PE file and has a suspicious name	System Summary
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet	System Summary
Uses an obfuscated file name to hide its real file extension (double extension)	Hooking and other Techniques for Hiding and Protection	Masquerading Obfuscated Files or Information
Yara detected Generic Downloader	Networking
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: Powershell Defender Exclusion	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe

"C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe"

Details

Is windows:	false
Is dropped:	false
PID:	5856
Target ID:	5
Parent PID:	6636
Name:	Catalina - Particulars.pdf.scr.exe
Path:	C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe
Commandline:	"C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe"
Size:	671744
MD5:	316329F616D991C23B6718BA353A6B3A
Time:	00:22:55
Date:	29/08/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x5a0000
Modulesize:	696320
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AntiVM3	Malware Analysis System Evasion
Adds a directory exclusion to Windows Defender	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Initial sample is a PE file and has a suspicious name	System Summary
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Machine Learning detection for sample	AV Detection
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet	System Summary
Uses an obfuscated file name to hide its real file extension (double extension)	Hooking and other Techniques for Hiding and Protection	Masquerading Obfuscated Files or Information
Yara detected Generic Downloader	Networking
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: Powershell Defender Exclusion	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sigma detected: Non Interactive PowerShell Process Spawned	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Windows\System32\conhost.exe

C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Details

Is windows:	true
Is dropped:	false
PID:	648
Target ID:	4
Parent PID:	2120
Name:	conhost.exe
Path:	C:\Windows\System32\conhost.exe
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Size:	862208
MD5:	0D698AF330FD17BEE3BF90011D49251D
Time:	00:22:55
Date:	29/08/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x7ff7699e0000
Modulesize:	892928
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://api.ipify.org/

172.67.74.152

http://www.apache.org/licenses/LICENSE-2.0

unknown

http://www.fontbureau.com

unknown

http://www.fontbureau.com/designersG

unknown

http://www.fontbureau.com/designers/?

unknown

http://www.founder.com.cn/cn/bThe

unknown

https://account.dyn.com/

unknown

http://www.fontbureau.com/designers?

unknown

http://www.tiro.com

unknown

http://www.fontbureau.com/designers

unknown

http://www.goodfont.co.kr

unknown

https://api.ipify.org/t

unknown

http://www.carterandcone.coml

unknown

http://www.sajatypeworks.com

unknown

http://www.typography.netD

unknown

http://www.fontbureau.com/designers/cabarga.htmlN

unknown

http://www.founder.com.cn/cn/cThe

unknown

http://www.galapagosdesign.com/staff/dennis.htm

unknown

https://api.ipify.org

unknown

http://www.founder.com.cn/cn

unknown

http://www.fontbureau.com/designers/frere-user.html

unknown

http://www.jiyu-kobo.co.jp/

unknown

http://www.galapagosdesign.com/DPlease

unknown

http://www.fontbureau.com/designers8

unknown

http://www.fonts.com

unknown

http://www.sandoll.co.kr

unknown

http://www.microsoft.c

unknown

http://www.urwpp.deDPlease

unknown

http://www.zhongyicts.com.cn

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

http://www.sakkal.com

unknown

http://beirutrest.com

unknown

There are 22 hidden URLs, click here to show them.

Domains

Name

Malicious

beirutrest.com

50.87.144.157

Details

Name:	beirutrest.com
IP:	50.87.144.157
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

api.ipify.org

172.67.74.152

Details

Name:	api.ipify.org
IP:	172.67.74.152
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

IPs

Domain

Country

Malicious

50.87.144.157

beirutrest.com

United States

172.67.74.152

api.ipify.org

United States

Details

IP:	172.67.74.152
TargetID:	5
Current Path:	C:\Users\user\Desktop\Catalina - Particulars.pdf.scr.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	api.ipify.org

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Catalina - Particulars_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Catalina - Particulars_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Catalina - Particulars_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Catalina - Particulars_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Catalina - Particulars_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Catalina - Particulars_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Catalina - Particulars_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Catalina - Particulars_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Catalina - Particulars_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Catalina - Particulars_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Catalina - Particulars_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Catalina - Particulars_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Catalina - Particulars_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Catalina - Particulars_RASMANCS

FileDirectory

There are 5 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

29A1000

trusted library allocation

page read and write

402000

remote allocation

page execute and read and write

29C7000

trusted library allocation

page read and write

36A9000

trusted library allocation

page read and write

6717000

trusted library allocation

page read and write

4E36000

trusted library allocation

page read and write

26ED000

trusted library allocation

page execute and read and write

9AD000

stack

page read and write

6220000

heap

page read and write

36A1000

trusted library allocation

page read and write

6E00000

trusted library allocation

page read and write

B50E000

stack

page read and write

B74E000

stack

page read and write

C10000

heap

page read and write

84C8000

heap

page read and write

9F3000

trusted library allocation

page read and write

84F7000

heap

page read and write

2800000

heap

page execute and read and write

39A000

stack

page read and write

4E4A000

trusted library allocation

page read and write

CB8000

trusted library allocation

page read and write

26E4000

trusted library allocation

page read and write

B54B000

stack

page read and write

26E3000

trusted library allocation

page execute and read and write

9D0000

trusted library allocation

page read and write

277E000

stack

page read and write

700000

heap

page read and write

4EE3000

heap

page read and write

4CE0000

trusted library allocation

page read and write

270E000

trusted library allocation

page read and write

27F4000

trusted library allocation

page read and write

4D90000

heap

page read and write

B18E000

stack

page read and write

271B000

trusted library allocation

page execute and read and write

66CE000

stack

page read and write

3951000

trusted library allocation

page read and write

503E000

heap

page read and write

6C00000

heap

page read and write

D80000

heap

page read and write

260000

unkown

page readonly

4EF0000

heap

page read and write

294E000

stack

page read and write

6610000

trusted library allocation

page read and write

8490000

heap

page read and write

27C0000

trusted library allocation

page execute and read and write

4AEB000

trusted library allocation

page read and write

F1E000

stack

page read and write

7E9000

heap

page read and write

4E42000

trusted library allocation

page read and write

6CCE000

stack

page read and write

62AA000

heap

page read and write

5100000

heap

page read and write

9FD000

trusted library allocation

page execute and read and write

634E000

stack

page read and write

65A8000

trusted library allocation

page read and write

775000

heap

page read and write

4AE0000

trusted library allocation

page read and write

5F8E000

stack

page read and write

6E20000

trusted library allocation

page execute and read and write

26E0000

trusted library allocation

page read and write

4EE0000

trusted library allocation

page read and write

2702000

trusted library allocation

page read and write

4C90000

trusted library allocation

page read and write

6840000

trusted library allocation

page read and write

C49000

heap

page read and write

2706000

trusted library allocation

page execute and read and write

4E56000

trusted library allocation

page read and write

C12000

trusted library allocation

page read and write

27F0000

trusted library allocation

page read and write

4E30000

trusted library allocation

page read and write

B2CE000

stack

page read and write

B40E000

stack

page read and write

4C70000

heap

page read and write

4E3E000

trusted library allocation

page read and write

A40000

heap

page read and write

C28000

heap

page read and write

D50000

trusted library allocation

page read and write

6DA000

stack

page read and write

854000

heap

page read and write

670E000

stack

page read and write

26FD000

trusted library allocation

page execute and read and write

770000

heap

page read and write

2710000

trusted library allocation

page read and write

B55000

heap

page read and write

B9E000

stack

page read and write

2700000

trusted library allocation

page read and write

4DA0000

heap

page execute and read and write

4EB0000

heap

page execute and read and write

298F000

trusted library allocation

page read and write

C90000

heap

page read and write

AC00000

heap

page read and write

65C7000

trusted library allocation

page read and write

4B9B000

stack

page read and write

84D0000

heap

page read and write

6C40000

trusted library allocation

page execute and read and write

B04E000

stack

page read and write

4CA0000

trusted library allocation

page read and write

6DD0000

trusted library section

page read and write

6D0E000

stack

page read and write

710000

heap

page read and write

6E30000

trusted library allocation

page read and write

75E000

stack

page read and write

4CC0000

heap

page read and write

65A0000

trusted library allocation

page read and write

2715000

trusted library allocation

page execute and read and write

65B0000

trusted library allocation

page read and write

5E8D000

stack

page read and write

306000

unkown

page readonly

6226000

heap

page read and write

AEFE000

stack

page read and write

4E4E000

trusted library allocation

page read and write

C60000

heap

page execute and read and write

2680000

trusted library allocation

page read and write

65C0000

trusted library allocation

page read and write

88A000

heap

page read and write

B30000

heap

page read and write

4B0D000

trusted library allocation

page read and write

4E5D000

trusted library allocation

page read and write

29DD000

trusted library allocation

page read and write

6862000

trusted library allocation

page read and write

B64C000

stack

page read and write

4D00000

trusted library section

page readonly

6F7000

stack

page read and write

4EF0000

trusted library allocation

page execute and read and write

5000000

heap

page read and write

4C80000

trusted library allocation

page read and write

6DCE000

stack

page read and write

262000

unkown

page readonly

C16000

trusted library allocation

page execute and read and write

4B40000

trusted library allocation

page read and write

4B06000

trusted library allocation

page read and write

C53000

heap

page read and write

6FBE000

stack

page read and write

CB5000

heap

page read and write

4E3B000

trusted library allocation

page read and write

700D000

stack

page read and write

6990000

trusted library allocation

page execute and read and write

E1E000

stack

page read and write

B27000

heap

page read and write

7E0000

heap

page read and write

B0F000

stack

page read and write

3979000

trusted library allocation

page read and write

2986000

trusted library allocation

page read and write

2730000

trusted library allocation

page read and write

B50000

heap

page read and write

CAE000

stack

page read and write

4CF0000

trusted library allocation

page execute and read and write

9ED000

trusted library allocation

page execute and read and write

6620000

trusted library allocation

page execute and read and write

6710000

trusted library allocation

page read and write

6E36000

trusted library allocation

page read and write

660E000

stack

page read and write

629F000

heap

page read and write

26A1000

trusted library allocation

page read and write

C0F000

stack

page read and write

9E3000

trusted library allocation

page execute and read and write

B14E000

stack

page read and write

39B8000

trusted library allocation

page read and write

5270000

trusted library allocation

page read and write

6B80000

heap

page read and write

299D000

trusted library allocation

page read and write

7E2000

heap

page read and write

2690000

heap

page read and write

6DF0000

trusted library allocation

page read and write

4CD3000

heap

page read and write

266B000

stack

page read and write

6263000

heap

page read and write

850000

heap

page read and write

70FE000

stack

page read and write

D70000

trusted library allocation

page read and write

7AE000

heap

page read and write

2712000

trusted library allocation

page read and write

27BC000

stack

page read and write

4F05000

heap

page read and write

7220000

trusted library allocation

page execute and read and write

5010000

heap

page read and write

82E000

heap

page read and write

68CF000

stack

page read and write

9E4000

trusted library allocation

page read and write

26F0000

trusted library allocation

page read and write

6E7E000

stack

page read and write

B28E000

stack

page read and write

27E0000

trusted library allocation

page read and write

6F7F000

stack

page read and write

4E51000

trusted library allocation

page read and write

2810000

trusted library allocation

page read and write

4EAE000

stack

page read and write

7F9E0000

trusted library allocation

page execute and read and write

84E9000

heap

page read and write

62BE000

heap

page read and write

C1A000

trusted library allocation

page execute and read and write

4EAC000

stack

page read and write

270A000

trusted library allocation

page execute and read and write

C40000

trusted library allocation

page read and write

BE0000

heap

page read and write

4F00000

heap

page read and write

9F0000

trusted library allocation

page read and write

5019000

heap

page read and write

4CD0000

heap

page read and write

780000

heap

page read and write

2670000

trusted library allocation

page read and write

658E000

stack

page read and write

4958000

trusted library allocation

page read and write

5054000

heap

page read and write

5050000

heap

page read and write

4BB0000

trusted library allocation

page execute and read and write

5490000

heap

page read and write

B20000

heap

page read and write

648E000

stack

page read and write

C17000

heap

page read and write

84EE000

heap

page read and write

7D9000

stack

page read and write

D87000

heap

page read and write

4AED000

stack

page read and write

8590000

trusted library section

page read and write

69EE000

stack

page read and write

694E000

stack

page read and write

4EB0000

heap

page read and write

88C000

heap

page read and write

7C7000

heap

page read and write

2951000

trusted library allocation

page read and write

2675000

trusted library allocation

page read and write

6980000

heap

page read and write

7A0000

heap

page read and write

400000

remote allocation

page execute and read and write

B760000

trusted library allocation

page read and write

522C000

stack

page read and write

690E000

stack

page read and write

4B01000

trusted library allocation

page read and write

5280000

trusted library allocation

page read and write

C10000

trusted library allocation

page read and write

ADFE000

stack

page read and write

2717000

trusted library allocation

page execute and read and write

2840000

heap

page read and write

C56000

heap

page read and write

BDE000

stack

page read and write

4AFE000

trusted library allocation

page read and write

6720000

trusted library allocation

page read and write

27D0000

trusted library allocation

page read and write

4EE0000

heap

page read and write

6950000

trusted library allocation

page read and write

479C000

stack

page read and write

6630000

trusted library allocation

page execute and read and write

C20000

heap

page read and write

C27000

trusted library allocation

page execute and read and write

26D0000

trusted library allocation

page read and write

262F000

stack

page read and write

C50000

trusted library allocation

page execute and read and write

9E0000

trusted library allocation

page read and write

7D4000

heap

page read and write

D60000

trusted library allocation

page read and write

644E000

stack

page read and write

C2B000

trusted library allocation

page execute and read and write

B3CF000

stack

page read and write

65BD000

trusted library allocation

page read and write

B2A000

heap

page read and write

A00000

heap

page read and write

C22000

trusted library allocation

page read and write

There are 248 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Catalina - Particulars.pdf.scr.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportCatalina - Particulars.pdf.scr.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
Catalina - Particulars.pdf.scr.exe