Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

RFQ 002593810024350.bat.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	0.1992397179636888
Filename:	RFQ 002593810024350.bat.exe
Filesize:	80740352
MD5:	56b26dafc409e4a26b3cdff29655c634
SHA1:	28218cdb90ed415758fa8432d85344f373f62665
SHA256:	5a0a36413c389c4a1dd98ba0544e39b456b082825bb21245f84c0beefef74ccc
SHA512:	6cec01314d39458c23859a85dbb51ea3f6b7c7dbb1a931a89f3a0112b31550700e8c1ec9f37a269cfa37814830d50d36d7d6070398f9605398b2ee5e39076229
SSDEEP:	24576:ffmMv6Ckr7Mny5QLTRiUecmRoNOlwOjcFD:f3v+7/5QLTR3DOlw28
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection	Exploitation for Privilege Escalation Access Token Manipulation
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
Contains functionality to detect sleep reduction / modifications	Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to log keystrokes (.Net Source)	Key, Mouse, Clipboard, Microphone and Screen Capturing
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Switches to a custom stack to bypass stack traces	Malware Analysis System Evasion	Access Token Manipulation
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)	Malware Analysis System Evasion
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to block mouse and keyboard input (often used to hinder debugging)	Anti Debugging
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a window is minimized (may be used to check if an application is visible)	Hooking and other Techniques for Hiding and Protection	Application Window Discovery
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion
Contains functionality to launch a process as a different user	System Summary	Valid Accounts Native API
Contains functionality to launch a program with higher privileges	HIPS / PFW / Operating System Protection Evasion	Exploitation for Privilege Escalation Access Token Manipulation
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Process Discovery
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate keystroke presses	HIPS / PFW / Operating System Protection Evasion
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Access Token Manipulation Process Discovery Archive Collected Data Encrypted Channel
Found large amount of non-executed APIs	Malware Analysis System Evasion	Access Token Manipulation
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information Obfuscated Files or Information
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information	Access Token Manipulation System Shutdown/Reboot
Potential key logger detected (key state polling based)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Yara signature match	System Summary
.NET source code contains calls to encryption/decryption functions	System Summary	Disable or Modify Tools
Contains functionality for error logging	System Summary	Access Token Manipulation
Contains functionality to add an ACL to a security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to check free disk space	System Summary
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to instantiate COM classes	System Summary	Access Token Manipulation
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery System Information Discovery
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Creates temporary files	System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Reads ini files	System Summary
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Sample reads its own file content	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\leucoryx

data

modified

Details

File:	C:\Users\user\AppData\Local\Temp\leucoryx
Category:	modified
Dump:	leucoryx.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\RFQ 002593810024350.bat.exe
Type:	data
Entropy:	6.752151581885517
Encrypted:	false
Ssdeep:	6144:VzFW3czqc69YFaqSGuJo/9/LLOkd1YHZtLmLnyorkCarM63u9SXKFXQTc2YV3:jaqS309BZnZ63u93FXQo2YV3
Size:	245760
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\RFQ 002593810024350.bat.exe

"C:\Users\user\Desktop\RFQ 002593810024350.bat.exe"

Details

Is windows:	false
Is dropped:	false
PID:	5736
Target ID:	0
Parent PID:	4056
Name:	RFQ 002593810024350.bat.exe
Path:	C:\Users\user\Desktop\RFQ 002593810024350.bat.exe
Commandline:	"C:\Users\user\Desktop\RFQ 002593810024350.bat.exe"
Size:	80740352
MD5:	56B26DAFC409E4A26B3CDFF29655C634
Time:	04:53:31
Date:	07/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	741376
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected AntiVM3	Malware Analysis System Evasion
Initial sample is a PE file and has a suspicious name	System Summary
Yara detected Generic Downloader	Networking
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\user\Desktop\RFQ 002593810024350.bat.exe"

Details

Is windows:	true
Is dropped:	false
PID:	4800
Target ID:	8
Parent PID:	5736
Name:	RegSvcs.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Commandline:	"C:\Users\user\Desktop\RFQ 002593810024350.bat.exe"
Size:	45984
MD5:	9D352BC46709F0CB5EC974633A0C3C94
Time:	04:53:35
Date:	07/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xa90000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected Generic Downloader	Networking
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

http://ip-api.com0

unknown

http://flujoauditorias.cl

unknown

http://mail.flujoauditorias.cl

unknown

https://account.dyn.com/

unknown

Details

Name:	https://account.dyn.com/
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\RFQ 002593810024350.bat.exe
Source:	RFQ 002593810024350.bat.exe, 00000000.00000002.1309099241.0000000001680000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2512706033.0000000000402000.00000040.80000000.00040000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

Details

Name:	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
TargetID:	8
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000008.00000002.2515262887.0000000002F36000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2515262887.0000000002E71000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://ip-api.com/line/?fields=hosting

208.95.112.1

Details

Name:	http://ip-api.com/line/?fields=hosting
IP:	208.95.112.1
TargetID:	8
From Memory:	false
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
URLs found in memory or binary data	Networking

http://ip-api.com

unknown

Details

Name:	http://ip-api.com
TargetID:	8
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000008.00000002.2515262887.0000000002F48000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2515262887.0000000002E71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.2515262887.0000000002F50000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

flujoauditorias.cl

15.235.118.15

Details

Name:	flujoauditorias.cl
IP:	15.235.118.15
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

ip-api.com

208.95.112.1

Details

Name:	ip-api.com
IP:	208.95.112.1
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Check if machine is in data center or colocation facility	Malware Analysis System Evasion	Security Software Discovery
HTTP GET or POST without a user agent	Networking
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

mail.flujoauditorias.cl

unknown

Details

Name:	mail.flujoauditorias.cl
TargetID:	-1

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

IPs

Domain

Country

Malicious

208.95.112.1

ip-api.com

United States

15.235.118.15

flujoauditorias.cl

United States

Details

IP:	15.235.118.15
TargetID:	8
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	United States
Countrycode:	USA
ASN number:	71
ASN name:	HP-INTERNET-ASUS
Private:	false
Domain:	flujoauditorias.cl

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

FileDirectory

There are 5 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

1680000

direct allocation

page read and write

402000

system

page execute and read and write

8AF000

stack

page read and write

40BA000

heap

page read and write

61B0000

heap

page read and write

2F36000

trusted library allocation

page read and write

6198000

heap

page read and write

4001000

heap

page read and write

4000000

heap

page read and write

5520000

heap

page read and write

4353000

heap

page read and write

46E3000

direct allocation

page read and write

4001000

heap

page read and write

45C0000

direct allocation

page read and write

2EEC000

trusted library allocation

page read and write

1406000

heap

page read and write

500E000

stack

page read and write

11B0000

trusted library allocation

page read and write

401000

unkown

page execute read

4062000

heap

page read and write

4001000

heap

page read and write

2F72000

trusted library allocation

page read and write

48FE000

direct allocation

page read and write

4062000

heap

page read and write

2F5A000

trusted library allocation

page read and write

4063000

heap

page read and write

11E8000

heap

page read and write

48FE000

direct allocation

page read and write

3CEE000

heap

page read and write

4889000

direct allocation

page read and write

3F96000

heap

page read and write

1219000

heap

page read and write

40C7000

heap

page read and write

3E33000

heap

page read and write

11DB000

trusted library allocation

page execute and read and write

11C2000

trusted library allocation

page read and write

4001000

heap

page read and write

8E0000

heap

page read and write

3E39000

heap

page read and write

8EA000

heap

page read and write

48FE000

direct allocation

page read and write

2F80000

trusted library allocation

page read and write

4063000

heap

page read and write

4AB000

unkown

page readonly

4001000

heap

page read and write

74216000

unkown

page readonly

4001000

heap

page read and write

4760000

direct allocation

page read and write

4063000

heap

page read and write

4001000

heap

page read and write

46E3000

direct allocation

page read and write

4063000

heap

page read and write

160000

heap

page read and write

400000

unkown

page readonly

4001000

heap

page read and write

4889000

direct allocation

page read and write

46E3000

direct allocation

page read and write

4A7000

unkown

page read and write

1070000

trusted library allocation

page read and write

4063000

heap

page read and write

4000000

heap

page read and write

11C6000

trusted library allocation

page execute and read and write

68F0000

trusted library allocation

page execute and read and write

4001000

heap

page read and write

4001000

heap

page read and write

46E3000

direct allocation

page read and write

45C0000

direct allocation

page read and write

1095000

heap

page read and write

678E000

stack

page read and write

BE0000

heap

page read and write

3F51000

heap

page read and write

538B000

trusted library allocation

page read and write

2E40000

heap

page read and write

4001000

heap

page read and write

5AD0000

trusted library allocation

page read and write

3EF2000

heap

page read and write

40B6000

heap

page read and write

1090000

heap

page read and write

482000

unkown

page readonly

7F950000

trusted library allocation

page execute and read and write

4063000

heap

page read and write

11D2000

trusted library allocation

page read and write

2EA5000

trusted library allocation

page read and write

45C0000

direct allocation

page read and write

4001000

heap

page read and write

53A1000

trusted library allocation

page read and write

689F000

stack

page read and write

6790000

trusted library allocation

page read and write

3E2E000

heap

page read and write

3F5A000

heap

page read and write

1262000

heap

page read and write

74201000

unkown

page execute read

4001000

heap

page read and write

8EE000

heap

page read and write

12AB000

heap

page read and write

2DEE000

stack

page read and write

8B4000

stack

page read and write

4001000

heap

page read and write

4063000

heap

page read and write

4889000

direct allocation

page read and write

4063000

heap

page read and write

4062000

heap

page read and write

1400000

heap

page read and write

654D000

stack

page read and write

1083000

trusted library allocation

page execute and read and write

2F6E000

trusted library allocation

page read and write

4760000

direct allocation

page read and write

2F70000

heap

page read and write

2F74000

heap

page read and write

53B2000

trusted library allocation

page read and write

15EE000

stack

page read and write

4063000

heap

page read and write

11A0000

heap

page read and write

11AE000

stack

page read and write

11C0000

trusted library allocation

page read and write

592E000

stack

page read and write

3D50000

heap

page read and write

2E3C000

stack

page read and write

4055000

heap

page read and write

40C7000

heap

page read and write

53D0000

trusted library allocation

page read and write

B90000

heap

page read and write

3F96000

heap

page read and write

3E26000

heap

page read and write

1C0000

heap

page read and write

5523000

heap

page read and write

3F96000

heap

page read and write

5510000

heap

page read and write

48FE000

direct allocation

page read and write

6800000

trusted library allocation

page read and write

48FE000

direct allocation

page read and write

488D000

direct allocation

page read and write

2F5E000

trusted library allocation

page read and write

482000

unkown

page readonly

550D000

stack

page read and write

2DF0000

heap

page execute and read and write

668E000

stack

page read and write

4063000

heap

page read and write

4001000

heap

page read and write

488D000

direct allocation

page read and write

53A6000

trusted library allocation

page read and write

3E71000

trusted library allocation

page read and write

4063000

heap

page read and write

488D000

direct allocation

page read and write

6190000

heap

page read and write

2CEE000

stack

page read and write

4001000

heap

page read and write

7421D000

unkown

page read and write

5AD4000

trusted library allocation

page read and write

6B30000

heap

page read and write

1675000

heap

page read and write

4063000

heap

page read and write

2F30000

trusted library allocation

page read and write

4760000

direct allocation

page read and write

488D000

direct allocation

page read and write

4001000

heap

page read and write

16F0000

heap

page read and write

53AD000

trusted library allocation

page read and write

3C50000

heap

page read and write

4001000

heap

page read and write

11D0000

trusted library allocation

page read and write

4001000

heap

page read and write

3EF2000

heap

page read and write

4063000

heap

page read and write

4001000

heap

page read and write

1084000

trusted library allocation

page read and write

40B7000

heap

page read and write

4063000

heap

page read and write

15AF000

stack

page read and write

45C0000

direct allocation

page read and write

4063000

heap

page read and write

2F87000

trusted library allocation

page read and write

2EEA000

trusted library allocation

page read and write

12BB000

heap

page read and write

3E2A000

heap

page read and write

4760000

direct allocation

page read and write

3BB0000

heap

page read and write

6196000

heap

page read and write

3ED7000

trusted library allocation

page read and write

3C51000

heap

page read and write

11BD000

trusted library allocation

page execute and read and write

9A000

stack

page read and write

539A000

trusted library allocation

page read and write

3F51000

heap

page read and write

4063000

heap

page read and write

5350000

trusted library allocation

page execute and read and write

6797000

trusted library allocation

page read and write

61ED000

heap

page read and write

3F50000

heap

page read and write

4001000

heap

page read and write

4063000

heap

page read and write

110000

heap

page read and write

572C000

stack

page read and write

61B9000

heap

page read and write

2F48000

trusted library allocation

page read and write

5360000

trusted library allocation

page read and write

53C0000

trusted library allocation

page read and write

45C0000

direct allocation

page read and write

5370000

trusted library allocation

page read and write

67FD000

stack

page read and write

3ACB000

heap

page read and write

4E78000

trusted library allocation

page read and write

3ABF000

stack

page read and write

74200000

unkown

page readonly

4063000

heap

page read and write

4001000

heap

page read and write

4001000

heap

page read and write

5480000

heap

page execute and read and write

4001000

heap

page read and write

1650000

heap

page read and write

89F000

stack

page read and write

4451000

heap

page read and write

46E3000

direct allocation

page read and write

4001000

heap

page read and write

5380000

trusted library allocation

page read and write

664E000

stack

page read and write

1217000

heap

page read and write

4063000

heap

page read and write

54CE000

stack

page read and write

36BE000

stack

page read and write

45C0000

direct allocation

page read and write

4063000

heap

page read and write

4063000

heap

page read and write

4001000

heap

page read and write

48FE000

direct allocation

page read and write

3CCF000

heap

page read and write

4889000

direct allocation

page read and write

B2A000

stack

page read and write

11E0000

heap

page read and write

5AB0000

trusted library allocation

page read and write

6BA0000

heap

page read and write

2E71000

trusted library allocation

page read and write

108D000

trusted library allocation

page execute and read and write

490000

unkown

page write copy

1670000

heap

page read and write

61B5000

heap

page read and write

5530000

heap

page read and write

162E000

stack

page read and write

3E99000

trusted library allocation

page read and write

5AC0000

trusted library allocation

page read and write

40B6000

heap

page execute and read and write

919000

heap

page read and write

5A6E000

stack

page read and write

4760000

direct allocation

page read and write

5392000

trusted library allocation

page read and write

2E60000

heap

page read and write

539E000

trusted library allocation

page read and write

13F0000

trusted library allocation

page read and write

4063000

heap

page read and write

4063000

heap

page read and write

400000

unkown

page readonly

120A000

heap

page read and write

4001000

heap

page read and write

488D000

direct allocation

page read and write

67B0000

trusted library allocation

page execute and read and write

4889000

direct allocation

page read and write

4001000

heap

page read and write

1258000

heap

page read and write

488D000

direct allocation

page read and write

100000

heap

page read and write

538E000

trusted library allocation

page read and write

4AB000

unkown

page readonly

2EFA000

trusted library allocation

page read and write

6B60000

trusted library allocation

page read and write

4001000

heap

page read and write

4001000

heap

page read and write

4063000

heap

page read and write

1AE000

stack

page read and write

4760000

direct allocation

page read and write

1268000

heap

page read and write

7421F000

unkown

page readonly

4001000

heap

page read and write

4001000

heap

page read and write

3E14000

heap

page read and write

EF9000

stack

page read and write

2F60000

trusted library allocation

page read and write

15E000

stack

page read and write

5AC7000

trusted library allocation

page read and write

4063000

heap

page read and write

4001000

heap

page read and write

400000

system

page execute and read and write

4063000

heap

page read and write

3E23000

heap

page read and write

5386000

trusted library allocation

page read and write

582E000

stack

page read and write

4063000

heap

page read and write

1285000

heap

page read and write

1080000

trusted library allocation

page read and write

542C000

stack

page read and write

61C3000

heap

page read and write

3EF2000

heap

page read and write

4063000

heap

page read and write

46E3000

direct allocation

page read and write

11CA000

trusted library allocation

page execute and read and write

2F50000

trusted library allocation

page read and write

401000

unkown

page execute read

11D7000

trusted library allocation

page execute and read and write

490000

unkown

page read and write

4063000

heap

page read and write

3EF2000

heap

page read and write

4889000

direct allocation

page read and write

4063000

heap

page read and write

4001000

heap

page read and write

67A0000

trusted library allocation

page read and write

3F45000

heap

page read and write

596E000

stack

page read and write

There are 296 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
RFQ 002593810024350.bat.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportRFQ 002593810024350.bat.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
RFQ 002593810024350.bat.exe