IOC Report
CMR_7649.EXE.exe

loading gif

Files

File Path
Type
Category
Malicious
CMR_7649.EXE.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\savager
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\CMR_7649.EXE.exe
"C:\Users\user\Desktop\CMR_7649.EXE.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\CMR_7649.EXE.exe"
 malicious

URLs

Name
IP
Malicious
http://aborters.duckdns.org:8081
unknown
 malicious
http://anotherarmy.dns.army:8081
unknown
 malicious
https://www.office.com/
unknown
https://api.telegram.org
unknown
https://api.telegram.org/bot
unknown
https://www.office.com/lB
unknown
http://checkip.dyndns.org
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://reallyfreegeoip.org/xml/8.46.123.33
188.114.96.3
https://api.telegram.org/bot/sendMessage?chat_id=&text=
unknown
https://chrome.google.com/webstore?hl=en
unknown
http://varders.kozow.com:8081
unknown
http://checkip.dyndns.org/
193.122.130.0
https://reallyfreegeoip.org/xml/8.46.123.33$
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:965543%0D%0ADate%20a
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
http://checkip.dyndns.org/q
unknown
https://chrome.google.com/webstore?hl=enlB
unknown
https://reallyfreegeoip.org
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:965543%0D%0ADate%20and%20Time:%2026/09/2024%20/%2014:19:29%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20965543%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D
149.154.167.220
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 15 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
reallyfreegeoip.org
188.114.96.3
 malicious
api.telegram.org
149.154.167.220
 malicious
checkip.dyndns.org
unknown
 malicious
checkip.dyndns.com
193.122.130.0

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
malicious
188.114.96.3
reallyfreegeoip.org
European Union
malicious
193.122.130.0
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
system
page execute and read and write
 malicious
2F91000
trusted library allocation
page read and write
 malicious
3760000
direct allocation
page read and write
 malicious
489D000
direct allocation
page read and write
4899000
direct allocation
page read and write
4770000
direct allocation
page read and write
1330000
trusted library allocation
page read and write
3F31000
heap
page read and write
3EDC000
heap
page execute and read and write
3F31000
heap
page read and write
366E000
stack
page read and write
3FAE000
heap
page read and write
3FAE000
heap
page read and write
3F91000
trusted library allocation
page read and write
2F70000
trusted library allocation
page read and write
6D90000
heap
page read and write
6DA0000
heap
page read and write
3148000
trusted library allocation
page read and write
3006000
trusted library allocation
page read and write
1E0000
heap
page read and write
4448000
heap
page read and write
489D000
direct allocation
page read and write
6D30000
trusted library allocation
page execute and read and write
3310000
trusted library allocation
page read and write
1280000
heap
page read and write
4770000
direct allocation
page read and write
6C40000
trusted library allocation
page execute and read and write
6C3E000
stack
page read and write
3F31000
heap
page read and write
2E7D000
heap
page read and write
1340000
trusted library allocation
page read and write
3F31000
heap
page read and write
45D0000
direct allocation
page read and write
3F31000
heap
page read and write
3FAE000
heap
page read and write
3F31000
heap
page read and write
A9E000
stack
page read and write
3F31000
heap
page read and write
45D0000
direct allocation
page read and write
1346000
trusted library allocation
page execute and read and write
3FAD000
heap
page read and write
3C2F000
stack
page read and write
433E000
heap
page read and write
3FAE000
heap
page read and write
4AB000
unkown
page readonly
1357000
trusted library allocation
page execute and read and write
3EED000
heap
page read and write
3F31000
heap
page read and write
3E1F000
heap
page read and write
2ED8000
trusted library allocation
page read and write
45D0000
direct allocation
page read and write
3037000
trusted library allocation
page read and write
4310000
trusted library allocation
page read and write
3EB3000
heap
page read and write
3F31000
heap
page read and write
4212000
trusted library allocation
page read and write
3047000
trusted library allocation
page read and write
3FAE000
heap
page read and write
490000
unkown
page read and write
3FAE000
heap
page read and write
333E000
trusted library allocation
page read and write
4899000
direct allocation
page read and write
490E000
direct allocation
page read and write
3F31000
heap
page read and write
3FAE000
heap
page read and write
489D000
direct allocation
page read and write
140E000
stack
page read and write
4899000
direct allocation
page read and write
1342000
trusted library allocation
page read and write
3FAE000
heap
page read and write
3F31000
heap
page read and write
3FAE000
heap
page read and write
3184000
trusted library allocation
page read and write
3F31000
heap
page read and write
3F31000
heap
page read and write
3E43000
heap
page read and write
93E000
stack
page read and write
6CF0000
trusted library allocation
page execute and read and write
1350000
trusted library allocation
page read and write
3EED000
heap
page read and write
3FAE000
heap
page read and write
401000
unkown
page execute read
6D50000
trusted library allocation
page read and write
4123000
trusted library allocation
page read and write
3399000
trusted library allocation
page read and write
681E000
heap
page read and write
46F3000
direct allocation
page read and write
42F0000
trusted library allocation
page read and write
4260000
trusted library allocation
page read and write
3F31000
heap
page read and write
5550000
heap
page read and write
3F31000
heap
page read and write
40AC000
trusted library allocation
page read and write
492000
unkown
page read and write
3FAE000
heap
page read and write
3153000
trusted library allocation
page read and write
3FAC000
heap
page read and write
317F000
trusted library allocation
page read and write
2F80000
heap
page execute and read and write
544E000
stack
page read and write
489D000
direct allocation
page read and write
33F5000
trusted library allocation
page read and write
2F24000
heap
page read and write
2FF7000
trusted library allocation
page read and write
8B4000
stack
page read and write
8FE000
stack
page read and write
4770000
direct allocation
page read and write
3F31000
heap
page read and write
4224000
trusted library allocation
page read and write
32AA000
trusted library allocation
page read and write
5AED000
trusted library allocation
page read and write
697E000
stack
page read and write
680C000
heap
page read and write
404F000
trusted library allocation
page read and write
1370000
trusted library allocation
page read and write
3F31000
heap
page read and write
3F31000
heap
page read and write
133D000
trusted library allocation
page execute and read and write
490E000
direct allocation
page read and write
3F31000
heap
page read and write
400000
unkown
page readonly
3F9B000
trusted library allocation
page read and write
42C0000
trusted library allocation
page read and write
3FE7000
heap
page read and write
3F31000
heap
page read and write
42E5000
trusted library allocation
page read and write
3F69000
heap
page read and write
3E47000
heap
page read and write
42B3000
trusted library allocation
page read and write
3FAE000
heap
page read and write
482000
unkown
page readonly
4770000
direct allocation
page read and write
558D000
trusted library allocation
page read and write
3F31000
heap
page read and write
46F3000
direct allocation
page read and write
3F30000
heap
page read and write
3140000
trusted library allocation
page read and write
4024000
heap
page read and write
3FAE000
heap
page read and write
4A8000
unkown
page read and write
3FAE000
heap
page read and write
3FAE000
heap
page read and write
5AE0000
trusted library allocation
page read and write
145A000
heap
page read and write
13A0000
heap
page read and write
489D000
direct allocation
page read and write
5560000
trusted library allocation
page read and write
413B000
trusted library allocation
page read and write
4FCC000
stack
page read and write
3F31000
heap
page read and write
57A0000
heap
page read and write
3D30000
heap
page read and write
1137000
stack
page read and write
302F000
trusted library allocation
page read and write
3F31000
heap
page read and write
4283000
trusted library allocation
page read and write
3F31000
heap
page read and write
4262000
trusted library allocation
page read and write
3F31000
heap
page read and write
3F31000
heap
page read and write
4899000
direct allocation
page read and write
3480000
trusted library allocation
page read and write
3E3C000
heap
page read and write
46F3000
direct allocation
page read and write
4066000
trusted library allocation
page read and write
320C000
trusted library allocation
page read and write
3FA6000
heap
page read and write
3FAE000
heap
page read and write
3FAF000
heap
page read and write
4314000
trusted library allocation
page read and write
303B000
trusted library allocation
page read and write
14C2000
heap
page read and write
6D00000
trusted library allocation
page read and write
3F31000
heap
page read and write
1323000
trusted library allocation
page execute and read and write
3FF9000
trusted library allocation
page read and write
3E55000
heap
page read and write
40D4000
trusted library allocation
page read and write
3F31000
heap
page read and write
3C30000
heap
page read and write
4326000
trusted library allocation
page read and write
4203000
trusted library allocation
page read and write
3FAE000
heap
page read and write
402B000
heap
page read and write
1380000
heap
page read and write
940000
heap
page read and write
3F31000
heap
page read and write
3F31000
heap
page read and write
55A0000
trusted library allocation
page read and write
61FF000
unkown
page read and write
2ECE000
stack
page read and write
4226000
trusted library allocation
page read and write
490E000
direct allocation
page read and write
16CF000
stack
page read and write
4222000
trusted library allocation
page read and write
3F31000
heap
page read and write
42D8000
trusted library allocation
page read and write
45D0000
direct allocation
page read and write
8AF000
stack
page read and write
578A000
trusted library allocation
page read and write
4198000
trusted library allocation
page read and write
3ED8000
heap
page read and write
3F8C000
heap
page read and write
4080000
trusted library allocation
page read and write
1466000
heap
page read and write
6D27000
trusted library allocation
page read and write
4770000
direct allocation
page read and write
103A000
stack
page read and write
6C50000
trusted library allocation
page read and write
40C2000
trusted library allocation
page read and write
3FAE000
heap
page read and write
135B000
trusted library allocation
page execute and read and write
4316000
trusted library allocation
page read and write
4074000
trusted library allocation
page read and write
11A0000
heap
page read and write
3FAE000
heap
page read and write
557A000
trusted library allocation
page read and write
45D0000
direct allocation
page read and write
407E000
trusted library allocation
page read and write
3FAE000
heap
page read and write
4335000
trusted library allocation
page read and write
3FAE000
heap
page read and write
42FC000
trusted library allocation
page read and write
A40000
heap
page read and write
557E000
trusted library allocation
page read and write
407A000
trusted library allocation
page read and write
3F31000
heap
page read and write
6C90000
trusted library allocation
page execute and read and write
5566000
trusted library allocation
page read and write
3FAE000
heap
page read and write
42CD000
trusted library allocation
page read and write
3F31000
heap
page read and write
3FAE000
heap
page read and write
3F31000
heap
page read and write
3F31000
heap
page read and write
3FAE000
heap
page read and write
4218000
trusted library allocation
page read and write
4242000
trusted library allocation
page read and write
5770000
trusted library allocation
page read and write
162E000
stack
page read and write
3F31000
heap
page read and write
66BE000
stack
page read and write
5581000
trusted library allocation
page read and write
100000
heap
page read and write
3FAE000
heap
page read and write
432D000
trusted library allocation
page read and write
ADA000
heap
page read and write
3F31000
heap
page read and write
2FFA000
trusted library allocation
page read and write
3099000
trusted library allocation
page read and write
12CE000
stack
page read and write
3FAE000
heap
page read and write
405F000
trusted library allocation
page read and write
3E50000
heap
page read and write
304F000
trusted library allocation
page read and write
4174000
trusted library allocation
page read and write
6D10000
trusted library allocation
page read and write
4082000
trusted library allocation
page read and write
1324000
trusted library allocation
page read and write
4049000
trusted library allocation
page read and write
3077000
trusted library allocation
page read and write
32E3000
trusted library allocation
page read and write
6828000
heap
page read and write
2F20000
heap
page read and write
3FAE000
heap
page read and write
3FAE000
heap
page read and write
572E000
stack
page read and write
3FAE000
heap
page read and write
3E01000
heap
page read and write
3EF8000
heap
page read and write
4250000
trusted library allocation
page read and write
33C7000
trusted library allocation
page read and write
67C0000
heap
page read and write
3FAE000
heap
page read and write
134A000
trusted library allocation
page execute and read and write
12EE000
stack
page read and write
3F9E000
heap
page read and write
3FAE000
heap
page read and write
4899000
direct allocation
page read and write
3179000
trusted library allocation
page read and write
3EDD000
heap
page read and write
5ADE000
stack
page read and write
6D60000
trusted library allocation
page execute and read and write
3E37000
heap
page read and write
3FAE000
heap
page read and write
31A3000
trusted library allocation
page read and write
554E000
stack
page read and write
3FAE000
heap
page read and write
491000
unkown
page write copy
B0A000
heap
page read and write
562E000
stack
page read and write
3F31000
heap
page read and write
3F31000
heap
page read and write
A00000
heap
page read and write
50CE000
stack
page read and write
9AE000
stack
page read and write
3F31000
heap
page read and write
3F31000
heap
page read and write
3F31000
heap
page read and write
4216000
trusted library allocation
page read and write
42E2000
trusted library allocation
page read and write
9C0000
heap
page read and write
6820000
heap
page read and write
6C70000
trusted library allocation
page execute and read and write
67BF000
stack
page read and write
314E000
trusted library allocation
page read and write
3FAE000
heap
page read and write
A50000
heap
page read and write
409E000
trusted library allocation
page read and write
A55000
heap
page read and write
3FAE000
heap
page read and write
693E000
stack
page read and write
327A000
trusted library allocation
page read and write
4309000
trusted library allocation
page read and write
556B000
trusted library allocation
page read and write
3144000
trusted library allocation
page read and write
55B0000
trusted library allocation
page read and write
3F31000
heap
page read and write
42E8000
trusted library allocation
page read and write
40BB000
trusted library allocation
page read and write
3F31000
heap
page read and write
60FE000
stack
page read and write
5784000
trusted library allocation
page read and write
3F31000
heap
page read and write
3F31000
heap
page read and write
4146000
trusted library allocation
page read and write
A05000
heap
page read and write
31AB000
trusted library allocation
page read and write
132D000
trusted library allocation
page execute and read and write
3FAE000
heap
page read and write
3177000
trusted library allocation
page read and write
5786000
trusted library allocation
page read and write
4072000
trusted library allocation
page read and write
3452000
trusted library allocation
page read and write
40BE000
trusted library allocation
page read and write
3FB9000
trusted library allocation
page read and write
4023000
heap
page read and write
1438000
heap
page read and write
367A000
heap
page read and write
41F3000
trusted library allocation
page read and write
1430000
heap
page read and write
AD0000
heap
page read and write
12A0000
heap
page read and write
14E9000
heap
page read and write
3FAE000
heap
page read and write
404D000
trusted library allocation
page read and write
3FAE000
heap
page read and write
3FAE000
heap
page read and write
4180000
trusted library allocation
page read and write
3F12000
heap
page read and write
490E000
direct allocation
page read and write
3175000
trusted library allocation
page read and write
3F31000
heap
page read and write
3F31000
heap
page read and write
42C7000
trusted library allocation
page read and write
420A000
trusted library allocation
page read and write
40DB000
trusted library allocation
page read and write
3129000
trusted library allocation
page read and write
1310000
trusted library allocation
page read and write
490E000
direct allocation
page read and write
3EDD000
heap
page read and write
3FAE000
heap
page read and write
1410000
heap
page read and write
3002000
trusted library allocation
page read and write
46F3000
direct allocation
page read and write
13B0000
trusted library allocation
page read and write
1352000
trusted library allocation
page read and write
3F31000
heap
page read and write
489D000
direct allocation
page read and write
3033000
trusted library allocation
page read and write
2FEC000
trusted library allocation
page read and write
5B00000
trusted library allocation
page read and write
421E000
trusted library allocation
page read and write
3171000
trusted library allocation
page read and write
3EE0000
heap
page read and write
4AB000
unkown
page readonly
376B000
heap
page read and write
1390000
trusted library allocation
page execute and read and write
684A000
heap
page read and write
46F3000
direct allocation
page read and write
45D0000
direct allocation
page read and write
336B000
trusted library allocation
page read and write
5AF0000
trusted library allocation
page execute and read and write
304B000
trusted library allocation
page read and write
3763000
heap
page read and write
3FAE000
heap
page read and write
46F3000
direct allocation
page read and write
3123000
trusted library allocation
page read and write
ADE000
heap
page read and write
6C60000
trusted library allocation
page execute and read and write
3E4D000
heap
page read and write
427A000
trusted library allocation
page read and write
6B3E000
stack
page read and write
3FAE000
heap
page read and write
13C0000
heap
page read and write
490000
unkown
page write copy
4770000
direct allocation
page read and write
406E000
trusted library allocation
page read and write
5790000
heap
page execute and read and write
576E000
stack
page read and write
3FAF000
heap
page read and write
3424000
trusted library allocation
page read and write
6C80000
trusted library allocation
page execute and read and write
2FE0000
trusted library allocation
page read and write
401000
unkown
page execute read
4899000
direct allocation
page read and write
400000
system
page execute and read and write
5592000
trusted library allocation
page read and write
3146000
trusted library allocation
page read and write
3FA1000
heap
page read and write
9A000
stack
page read and write
400000
unkown
page readonly
3F31000
heap
page read and write
151F000
heap
page read and write
303F000
trusted library allocation
page read and write
3FB3000
trusted library allocation
page read and write
300A000
trusted library allocation
page read and write
3FAE000
heap
page read and write
40E3000
trusted library allocation
page read and write
41F1000
trusted library allocation
page read and write
41ED000
trusted library allocation
page read and write
3FAE000
heap
page read and write
482000
unkown
page readonly
556E000
trusted library allocation
page read and write
12A5000
heap
page read and write
4029000
heap
page read and write
6D40000
trusted library allocation
page read and write
3FAE000
heap
page read and write
3F31000
heap
page read and write
1355000
trusted library allocation
page execute and read and write
2ED0000
trusted library allocation
page read and write
3FAE000
heap
page read and write
31DC000
trusted library allocation
page read and write
40C4000
trusted library allocation
page read and write
1320000
trusted library allocation
page read and write
3F31000
heap
page read and write
6A7E000
stack
page read and write
A10000
heap
page read and write
3FAE000
heap
page read and write
3043000
trusted library allocation
page read and write
3FAE000
heap
page read and write
4144000
trusted library allocation
page read and write
490E000
direct allocation
page read and write
3FAE000
heap
page read and write
5586000
trusted library allocation
page read and write
6D20000
trusted library allocation
page read and write
3FAE000
heap
page read and write
68FE000
stack
page read and write
4285000
trusted library allocation
page read and write
3FAE000
heap
page read and write
42D4000
trusted library allocation
page read and write
5553000
heap
page read and write
There are 442 hidden memdumps, click here to show them.