IOC Report
Fatura 002.xlam.xlsx

loading gif

Files

File Path
Type
Category
Malicious
Fatura 002.xlam.xlsx
Microsoft Excel 2007+
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\food[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\coolz.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\Desktop\~$Fatura 002.xlam.xlsx
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\prespecialist
data
dropped
C:\Users\user\Desktop\~$Fatura 002.xlam.xls
data
dropped

Processes

Path
Cmdline
Malicious
C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
 malicious
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
 malicious
C:\Users\user\AppData\Local\Temp\coolz.exe
C:\Users\user\AppData\Local\Temp\coolz.exe
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
C:\Users\user\AppData\Local\Temp\coolz.exe
 malicious

URLs

Name
IP
Malicious
https://menyos.com/assets/home/js/bdg/food.exe
104.21.35.109
 malicious
https://menyos.com/assets/home/js/bdg/food.exeiiC:
unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
unknown
http://crl.entrust.net/server1.crl0
unknown
https://menyos.com/assets/home/js/bdg/food.exeC:
unknown
http://ocsp.entrust.net03
unknown
https://menyos.com/5m/
unknown
https://menyos.com/assets/home/js/bdg/food.exeuj
unknown
https://menyos.com//m/
unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
unknown
http://www.diginotar.nl/cps/pkioverheid0
unknown
http://ocsp.entrust.net0D
unknown
https://secure.comodo.com/CPS0
unknown
https://menyos.com/assets/home/js/bdg/food.exefj
unknown
https://menyos.com/assets/home/js/bdg/food.exej
unknown
http://crl.entrust.net/2048ca.crl0
unknown
There are 6 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
menyos.com
104.21.35.109
 malicious

IPs

IP
Domain
Country
Malicious
104.21.35.109
menyos.com
United States
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C
Blob
 malicious
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
# /
HKEY_CURRENT_USER\Software\Microsoft\Shared Tools\Outlook\Journaling\Microsoft Excel
Enabled
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
MTTT
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\ReviewCycle
ReviewToken
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
s$/
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Security\Trusted Documents
LastPurgeTime
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
EXCELFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
ProductFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109D30000000100000000F01FEC\Usage
VBAFiles
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\00004109E60090400100000000F01FEC\Usage
EquationEditorFilesIntl_1033
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
SavedLegacySettings
There are 11 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
402000
system
page execute and read and write
 malicious
3AC0000
heap
page read and write
3AC0000
heap
page read and write
40F0000
heap
page read and write
3A20000
heap
page read and write
7040000
heap
page read and write
36B1000
heap
page read and write
28DF000
stack
page read and write
36A6000
heap
page read and write
3AC0000
direct allocation
page read and write
D0000
heap
page read and write
64E0000
heap
page read and write
36B0000
heap
page read and write
3A20000
heap
page read and write
89000
stack
page read and write
3F9000
stack
page read and write
3A20000
heap
page read and write
36B0000
heap
page read and write
3A4A000
direct allocation
page read and write
36B1000
heap
page read and write
36B0000
heap
page read and write
3A20000
heap
page read and write
36B0000
heap
page read and write
3AC0000
heap
page read and write
362B000
heap
page read and write
401000
unkown
page execute read
2001000
trusted library allocation
page read and write
36B1000
heap
page read and write
3AC0000
heap
page read and write
36B1000
heap
page read and write
3BC7000
direct allocation
page read and write
36B0000
heap
page read and write
2D0000
heap
page read and write
3BD0000
direct allocation
page read and write
10000
heap
page read and write
520000
heap
page read and write
3BC7000
direct allocation
page read and write
3AC0000
heap
page read and write
3A20000
heap
page read and write
3AC0000
heap
page read and write
36B0000
heap
page read and write
6524000
heap
page read and write
36B0000
heap
page read and write
3BB0000
direct allocation
page read and write
3A20000
heap
page read and write
1EE0000
heap
page read and write
68FF000
stack
page read and write
3970000
heap
page read and write
50D000
stack
page read and write
2C08000
heap
page read and write
3C30000
direct allocation
page read and write
3BC1000
direct allocation
page read and write
36B0000
heap
page read and write
3AC0000
heap
page read and write
7061000
heap
page read and write
5700000
heap
page read and write
3AC0000
heap
page read and write
1FFE000
stack
page read and write | page guard
36B0000
heap
page read and write
2DF000
heap
page read and write
3A20000
heap
page read and write
7B0000
heap
page read and write
650F000
heap
page read and write
5C8000
heap
page read and write
36B0000
heap
page read and write
36B0000
heap
page read and write
36B0000
heap
page read and write
2076000
trusted library allocation
page read and write
3A20000
heap
page read and write
36B0000
heap
page read and write
3A20000
heap
page read and write
3BB0000
direct allocation
page read and write
367C000
heap
page read and write
3A4A000
direct allocation
page read and write
3AC0000
heap
page read and write
36B1000
heap
page read and write
CD000
trusted library allocation
page execute and read and write
3A20000
heap
page read and write
3A4A000
direct allocation
page read and write
36AE000
heap
page read and write
24D4000
heap
page read and write
67A0000
remote allocation
page read and write
3A20000
heap
page read and write
3A20000
heap
page read and write
3A20000
heap
page read and write
162000
trusted library allocation
page read and write
3631000
heap
page read and write
3A20000
heap
page read and write
36B1000
heap
page read and write
367F000
heap
page read and write
3AC0000
heap
page read and write
527000
heap
page read and write
3BB0000
direct allocation
page read and write
36B0000
heap
page read and write
6D2C000
stack
page read and write
15D000
trusted library allocation
page execute and read and write
2C00000
heap
page read and write
166000
trusted library allocation
page execute and read and write
36B0000
heap
page read and write
58E000
heap
page read and write
3AC0000
heap
page read and write
362B000
heap
page read and write
3A20000
heap
page read and write
3BD0000
direct allocation
page read and write
482000
unkown
page readonly
3A20000
heap
page read and write
362B000
heap
page read and write
69A0000
heap
page read and write
3BC1000
direct allocation
page read and write
3AC0000
heap
page read and write
36B0000
heap
page read and write
4BD0000
heap
page execute and read and write
3970000
direct allocation
page read and write
36B0000
heap
page read and write
3AC0000
heap
page read and write
260000
trusted library allocation
page execute and read and write
3A20000
heap
page read and write
371A000
heap
page read and write
371A000
heap
page read and write
3AC0000
heap
page read and write
3AC0000
heap
page read and write
3AC0000
heap
page read and write
24D0000
heap
page read and write
477000
heap
page read and write
3AC0000
heap
page read and write
36B0000
heap
page read and write
36B0000
heap
page read and write
36B0000
heap
page read and write
3670000
heap
page read and write
3BC4000
direct allocation
page read and write
3A4D000
direct allocation
page read and write
3AC0000
heap
page read and write
3AC0000
heap
page read and write
4CE000
stack
page read and write
42EE000
stack
page read and write
36B0000
heap
page read and write
36AB000
heap
page read and write
36B0000
heap
page read and write
651F000
heap
page read and write
582000
heap
page read and write
1FFF000
stack
page read and write
3AC0000
heap
page read and write
4AB000
unkown
page readonly
51F000
heap
page read and write
42C000
system
page execute and read and write
3AC0000
heap
page read and write
36B0000
heap
page read and write
36B0000
heap
page read and write
490000
unkown
page write copy
4B7E000
stack
page read and write
36B0000
heap
page read and write
3632000
heap
page read and write
36B1000
heap
page read and write
3A20000
heap
page read and write
3AC0000
heap
page read and write
1ECE000
stack
page read and write
3AC0000
heap
page read and write
3C30000
direct allocation
page read and write
18A000
stack
page read and write
36B0000
heap
page read and write
3AD0000
direct allocation
page read and write
36B1000
heap
page read and write
3AC0000
heap
page read and write
3BC4000
direct allocation
page read and write
36B0000
heap
page read and write
36B0000
heap
page read and write
36B0000
heap
page read and write
5CC000
heap
page read and write
1CB000
stack
page read and write
36B0000
heap
page read and write
2B0000
trusted library allocation
page read and write
20B9000
trusted library allocation
page read and write
3A20000
heap
page read and write
3A20000
heap
page read and write
3EF000
stack
page read and write
36B0000
heap
page read and write
665E000
stack
page read and write
4F40000
heap
page read and write
20BC000
trusted library allocation
page read and write
363A000
heap
page read and write
3A20000
heap
page read and write
36B1000
heap
page read and write
577000
trusted library allocation
page read and write
36B0000
heap
page read and write
C0000
trusted library allocation
page read and write
676F000
stack
page read and write
3970000
direct allocation
page read and write
3A4D000
direct allocation
page read and write
3AC0000
heap
page read and write
3A20000
heap
page read and write
36B0000
heap
page read and write
2D7000
heap
page read and write
29DF000
stack
page read and write
1F40000
direct allocation
page read and write
7060000
heap
page read and write
400000
unkown
page readonly
416D000
stack
page read and write
66B0000
heap
page read and write
3AC0000
direct allocation
page read and write
56FF000
stack
page read and write
3A20000
heap
page read and write
2DD0000
heap
page read and write
36B0000
heap
page read and write
4BD000
heap
page read and write
5C7000
heap
page read and write
10000
heap
page read and write
3AC0000
heap
page read and write
270000
heap
page execute and read and write
3A20000
heap
page read and write
47FF000
stack
page read and write
36B0000
heap
page read and write
54F000
heap
page read and write
4F3E000
stack
page read and write
3A20000
heap
page read and write
362B000
heap
page read and write
1DE8000
trusted library allocation
page read and write
36B0000
heap
page read and write
4112000
heap
page read and write
36AF000
heap
page read and write
3AC0000
heap
page read and write
3A20000
heap
page read and write
36B1000
heap
page read and write
583000
heap
page read and write
46BE000
stack
page read and write
3AC0000
heap
page read and write
36B0000
heap
page read and write
366D000
stack
page read and write
36B1000
heap
page read and write
36B1000
heap
page read and write
369F000
heap
page read and write
36B0000
heap
page read and write
3A20000
heap
page read and write
3AC0000
heap
page read and write
3BC1000
direct allocation
page read and write
36B0000
heap
page read and write
36B0000
heap
page read and write
36B1000
heap
page read and write
3A20000
heap
page read and write
36B0000
heap
page read and write
7000000
heap
page read and write
3AC0000
heap
page read and write
36B0000
heap
page read and write
3970000
direct allocation
page read and write
69F0000
heap
page read and write
3A20000
heap
page read and write
3A20000
heap
page read and write
36B0000
heap
page read and write
3A4D000
direct allocation
page read and write
5D4000
heap
page read and write
517E000
stack
page read and write
36B1000
heap
page read and write
2C0B000
heap
page read and write
36B1000
heap
page read and write
1E8F000
stack
page read and write
3AC0000
heap
page read and write
250000
heap
page read and write
3AC0000
heap
page read and write
3AC0000
heap
page read and write
3A20000
heap
page read and write
203F000
trusted library allocation
page read and write
36B1000
heap
page read and write
6B2E000
stack
page read and write
2BDE000
stack
page read and write
40F4000
heap
page read and write
5930000
heap
page read and write
3BC1000
direct allocation
page read and write
150000
trusted library allocation
page read and write
3AC0000
heap
page read and write
3A20000
heap
page read and write
3A20000
heap
page read and write
3A20000
heap
page read and write
3AD0000
direct allocation
page read and write
2070000
trusted library allocation
page read and write
2ADF000
stack
page read and write
67A0000
remote allocation
page read and write
612000
heap
page read and write
2C04000
heap
page read and write
36B1000
heap
page read and write
3A4A000
direct allocation
page read and write
3AC0000
heap
page read and write
36B0000
heap
page read and write
3AC0000
heap
page read and write
36B0000
heap
page read and write
5708000
heap
page read and write
369F000
heap
page read and write
3029000
trusted library allocation
page read and write
51BE000
stack
page read and write
36B0000
heap
page read and write
581000
heap
page read and write
58F000
heap
page read and write
604000
heap
page read and write
618000
heap
page read and write
3A4A000
direct allocation
page read and write
3AC0000
heap
page read and write
46FF000
stack
page read and write
3AC0000
direct allocation
page read and write
172000
trusted library allocation
page read and write
3AC0000
heap
page read and write
3A20000
heap
page read and write
24F2000
heap
page read and write
7B7000
heap
page read and write
362B000
heap
page read and write
3632000
heap
page read and write
36B1000
heap
page read and write
3AC0000
heap
page read and write
36B0000
heap
page read and write
45FD000
stack
page read and write
5CC000
heap
page read and write
3AC0000
heap
page read and write
3AC0000
heap
page read and write
5CC000
heap
page read and write
544E000
stack
page read and write
3A20000
heap
page read and write
3A20000
heap
page read and write
36B0000
heap
page read and write
7EF40000
trusted library allocation
page execute and read and write
3A20000
heap
page read and write
370B000
heap
page read and write
4C0000
heap
page read and write
3A20000
heap
page read and write
16A000
trusted library allocation
page execute and read and write
36B0000
heap
page read and write
3C30000
direct allocation
page read and write
3A20000
heap
page read and write
36B0000
heap
page read and write
36B0000
heap
page read and write
175000
trusted library allocation
page execute and read and write
3A20000
heap
page read and write
160000
trusted library allocation
page read and write
1E4F000
stack
page read and write
3AC0000
heap
page read and write
17B000
trusted library allocation
page execute and read and write
366F000
heap
page read and write
3AC0000
heap
page read and write
6E2F000
stack
page read and write
3AC0000
heap
page read and write
36B0000
heap
page read and write
3AD0000
direct allocation
page read and write
4B90000
heap
page read and write
544000
heap
page read and write
3AC0000
heap
page read and write
3AC0000
heap
page read and write
630000
heap
page read and write
36B0000
heap
page read and write
3970000
direct allocation
page read and write
36B1000
heap
page read and write
3A20000
heap
page read and write
36B0000
heap
page read and write
3001000
trusted library allocation
page read and write
362B000
heap
page read and write
36B0000
heap
page read and write
36B0000
heap
page read and write
C3000
trusted library allocation
page execute and read and write
C4000
trusted library allocation
page read and write
36AF000
heap
page read and write
3AC0000
heap
page read and write
36B1000
heap
page read and write
460000
trusted library allocation
page execute and read and write
2E0000
heap
page read and write
470000
heap
page read and write
3AD0000
direct allocation
page read and write
3AC0000
heap
page read and write
36B1000
heap
page read and write
3A20000
heap
page read and write
2C0000
trusted library allocation
page read and write
64FD000
heap
page read and write
3BD0000
direct allocation
page read and write
3AD0000
direct allocation
page read and write
570000
trusted library allocation
page read and write
3A20000
heap
page read and write
1ECE000
stack
page read and write
36A8000
heap
page read and write
1F30000
heap
page read and write
36B1000
heap
page read and write
400000
system
page execute and read and write
3C30000
direct allocation
page read and write
5B0000
trusted library allocation
page read and write
3BC4000
direct allocation
page read and write
604000
heap
page read and write
3BC7000
direct allocation
page read and write
3A4D000
direct allocation
page read and write
494000
heap
page read and write
3BD0000
direct allocation
page read and write
243F000
stack
page read and write
672F000
stack
page read and write
3A20000
heap
page read and write
36B1000
heap
page read and write
3A20000
heap
page read and write
661E000
stack
page read and write
3AC0000
heap
page read and write
3A20000
heap
page read and write
3970000
direct allocation
page read and write
4B4000
heap
page read and write
3A4D000
direct allocation
page read and write
3BC7000
direct allocation
page read and write
36B0000
heap
page read and write
6C2F000
stack
page read and write
3A20000
heap
page read and write
67C0000
heap
page read and write
36B0000
heap
page read and write
58E000
heap
page read and write
3BB0000
direct allocation
page read and write
3A20000
heap
page read and write
36B0000
heap
page read and write
36B0000
heap
page read and write
B0000
trusted library allocation
page read and write
36B0000
heap
page read and write
5CD000
heap
page read and write
3BC4000
direct allocation
page read and write
4E1C000
stack
page read and write
3AC0000
direct allocation
page read and write
3AC0000
heap
page read and write
680000
heap
page execute and read and write
36B0000
heap
page read and write
36B0000
heap
page read and write
36B0000
heap
page read and write
1F2E000
stack
page read and write
3AC0000
direct allocation
page read and write
36B1000
heap
page read and write
36B0000
heap
page read and write
669C000
stack
page read and write
36B0000
heap
page read and write
6F2F000
stack
page read and write
177000
trusted library allocation
page execute and read and write
61E000
stack
page read and write
36B0000
heap
page read and write
36B0000
heap
page read and write
36B0000
heap
page read and write
3A20000
heap
page read and write
There are 419 hidden memdumps, click here to show them.