Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
SUNNY HONG VSL PARTICULARS.xlsx.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\Melber
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\SUNNY HONG VSL PARTICULARS.xlsx.exe
|
"C:\Users\user\Desktop\SUNNY HONG VSL PARTICULARS.xlsx.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\SUNNY HONG VSL PARTICULARS.xlsx.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://api.ipify.org/
|
172.67.74.152
|
||
|
https://api.ipify.org
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
https://api.ipify.org/t
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://beirutrest.com
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
beirutrest.com
|
50.87.144.157
|
|
|
|
api.ipify.org
|
172.67.74.152
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
50.87.144.157
|
beirutrest.com
|
United States
|
|
|
|
172.67.74.152
|
api.ipify.org
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2D0E000
|
heap
|
page read and write
|
|
|
|
5580000
|
trusted library section
|
page read and write
|
|
|
|
316F000
|
trusted library allocation
|
page read and write
|
|
|
|
40F1000
|
trusted library allocation
|
page read and write
|
|
|
|
55D0000
|
trusted library section
|
page read and write
|
|
|
|
3144000
|
trusted library allocation
|
page read and write
|
|
|
|
2CB2000
|
trusted library allocation
|
page read and write
|
||
|
2EBE000
|
stack
|
page read and write
|
||
|
40D3000
|
heap
|
page read and write
|
||
|
4860000
|
direct allocation
|
page read and write
|
||
|
A5E000
|
stack
|
page read and write
|
||
|
4860000
|
direct allocation
|
page read and write
|
||
|
5C3F000
|
stack
|
page read and write
|
||
|
5A42000
|
heap
|
page read and write
|
||
|
5536000
|
trusted library allocation
|
page read and write
|
||
|
3FA3000
|
heap
|
page read and write
|
||
|
6B14000
|
trusted library allocation
|
page read and write
|
||
|
2EC8000
|
trusted library allocation
|
page read and write
|
||
|
2E73000
|
heap
|
page read and write
|
||
|
3175000
|
trusted library allocation
|
page read and write
|
||
|
444000
|
system
|
page execute and read and write
|
||
|
4860000
|
direct allocation
|
page read and write
|
||
|
6B08000
|
trusted library allocation
|
page read and write
|
||
|
490000
|
unkown
|
page read and write
|
||
|
960000
|
heap
|
page read and write
|
||
|
1120000
|
trusted library allocation
|
page read and write
|
||
|
46C0000
|
direct allocation
|
page read and write
|
||
|
70FE000
|
stack
|
page read and write
|
||
|
112D000
|
trusted library allocation
|
page execute and read and write
|
||
|
2E40000
|
heap
|
page read and write
|
||
|
56BE000
|
stack
|
page read and write
|
||
|
554A000
|
trusted library allocation
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
136E000
|
stack
|
page read and write
|
||
|
47E3000
|
direct allocation
|
page read and write
|
||
|
553B000
|
trusted library allocation
|
page read and write
|
||
|
89F000
|
stack
|
page read and write
|
||
|
1110000
|
heap
|
page read and write
|
||
|
4989000
|
direct allocation
|
page read and write
|
||
|
554E000
|
trusted library allocation
|
page read and write
|
||
|
4060000
|
heap
|
page read and write
|
||
|
CBA000
|
stack
|
page read and write
|
||
|
40DA000
|
heap
|
page read and write
|
||
|
4989000
|
direct allocation
|
page read and write
|
||
|
11D0000
|
heap
|
page read and write
|
||
|
47E3000
|
direct allocation
|
page read and write
|
||
|
5D40000
|
heap
|
page read and write
|
||
|
6B7D000
|
stack
|
page read and write
|
||
|
49FE000
|
direct allocation
|
page read and write
|
||
|
47E3000
|
direct allocation
|
page read and write
|
||
|
3BC8000
|
heap
|
page read and write
|
||
|
6C0E000
|
stack
|
page read and write
|
||
|
BAF000
|
heap
|
page read and write
|
||
|
4061000
|
heap
|
page read and write
|
||
|
5B3E000
|
stack
|
page read and write
|
||
|
5A14000
|
heap
|
page read and write
|
||
|
1080000
|
heap
|
page read and write
|
||
|
3F45000
|
heap
|
page read and write
|
||
|
93E000
|
stack
|
page read and write
|
||
|
3074000
|
heap
|
page read and write
|
||
|
57BE000
|
stack
|
page read and write
|
||
|
6E4E000
|
stack
|
page read and write
|
||
|
5D50000
|
trusted library allocation
|
page execute and read and write
|
||
|
5542000
|
trusted library allocation
|
page read and write
|
||
|
2FC0000
|
trusted library allocation
|
page read and write
|
||
|
6B20000
|
trusted library allocation
|
page execute and read and write
|
||
|
BA6000
|
heap
|
page read and write
|
||
|
1133000
|
trusted library allocation
|
page read and write
|
||
|
5630000
|
trusted library allocation
|
page read and write
|
||
|
100000
|
heap
|
page read and write
|
||
|
117B000
|
heap
|
page read and write
|
||
|
57C0000
|
heap
|
page read and write
|
||
|
A10000
|
heap
|
page read and write
|
||
|
3F18000
|
heap
|
page read and write
|
||
|
2CB6000
|
trusted library allocation
|
page execute and read and write
|
||
|
498D000
|
direct allocation
|
page read and write
|
||
|
5556000
|
trusted library allocation
|
page read and write
|
||
|
402A000
|
heap
|
page read and write
|
||
|
47E3000
|
direct allocation
|
page read and write
|
||
|
316D000
|
trusted library allocation
|
page read and write
|
||
|
567D000
|
trusted library allocation
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
106E000
|
stack
|
page read and write
|
||
|
7FDB0000
|
trusted library allocation
|
page execute and read and write
|
||
|
699E000
|
stack
|
page read and write
|
||
|
689E000
|
stack
|
page read and write
|
||
|
30EE000
|
stack
|
page read and write
|
||
|
2E70000
|
heap
|
page read and write
|
||
|
553E000
|
trusted library allocation
|
page read and write
|
||
|
4061000
|
heap
|
page read and write
|
||
|
49FE000
|
direct allocation
|
page read and write
|
||
|
2E30000
|
heap
|
page read and write
|
||
|
4AB000
|
unkown
|
page readonly
|
||
|
6C60000
|
trusted library allocation
|
page read and write
|
||
|
4028000
|
heap
|
page read and write
|
||
|
8AF000
|
stack
|
page read and write
|
||
|
37BE000
|
stack
|
page read and write
|
||
|
2CC0000
|
trusted library allocation
|
page read and write
|
||
|
71C0000
|
heap
|
page read and write
|
||
|
5551000
|
trusted library allocation
|
page read and write
|
||
|
2F1C000
|
heap
|
page read and write
|
||
|
4989000
|
direct allocation
|
page read and write
|
||
|
46C0000
|
direct allocation
|
page read and write
|
||
|
9DE000
|
stack
|
page read and write
|
||
|
41B2000
|
trusted library allocation
|
page read and write
|
||
|
5562000
|
trusted library allocation
|
page read and write
|
||
|
1070000
|
heap
|
page read and write
|
||
|
4148000
|
heap
|
page read and write
|
||
|
3F29000
|
heap
|
page read and write
|
||
|
2CC2000
|
trusted library allocation
|
page read and write
|
||
|
47E3000
|
direct allocation
|
page read and write
|
||
|
3020000
|
heap
|
page read and write
|
||
|
46C0000
|
direct allocation
|
page read and write
|
||
|
5570000
|
heap
|
page execute and read and write
|
||
|
3140000
|
trusted library allocation
|
page read and write
|
||
|
5ACC000
|
heap
|
page read and write
|
||
|
403D000
|
heap
|
page read and write
|
||
|
6B30000
|
trusted library allocation
|
page read and write
|
||
|
8FE000
|
stack
|
page read and write
|
||
|
2CCB000
|
trusted library allocation
|
page execute and read and write
|
||
|
6E90000
|
trusted library allocation
|
page read and write
|
||
|
2CB0000
|
trusted library allocation
|
page read and write
|
||
|
30F1000
|
trusted library allocation
|
page read and write
|
||
|
3F33000
|
heap
|
page read and write
|
||
|
1E0000
|
heap
|
page read and write
|
||
|
51EE000
|
stack
|
page read and write
|
||
|
498D000
|
direct allocation
|
page read and write
|
||
|
2FAC000
|
stack
|
page read and write
|
||
|
3BBF000
|
stack
|
page read and write
|
||
|
10DE000
|
stack
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
1148000
|
heap
|
page read and write
|
||
|
47E3000
|
direct allocation
|
page read and write
|
||
|
940000
|
heap
|
page read and write
|
||
|
58FC000
|
stack
|
page read and write
|
||
|
4989000
|
direct allocation
|
page read and write
|
||
|
176F000
|
stack
|
page read and write
|
||
|
3F7F000
|
heap
|
page read and write
|
||
|
498D000
|
direct allocation
|
page read and write
|
||
|
4860000
|
direct allocation
|
page read and write
|
||
|
4A7000
|
unkown
|
page read and write
|
||
|
316B000
|
trusted library allocation
|
page read and write
|
||
|
B7A000
|
heap
|
page read and write
|
||
|
402A000
|
heap
|
page read and write
|
||
|
69DE000
|
stack
|
page read and write
|
||
|
10E0000
|
trusted library section
|
page read and write
|
||
|
980000
|
heap
|
page read and write
|
||
|
A00000
|
heap
|
page read and write
|
||
|
4461000
|
heap
|
page read and write
|
||
|
312A000
|
trusted library allocation
|
page read and write
|
||
|
A05000
|
heap
|
page read and write
|
||
|
1020000
|
heap
|
page read and write
|
||
|
2E00000
|
trusted library allocation
|
page execute and read and write
|
||
|
2CC5000
|
trusted library allocation
|
page execute and read and write
|
||
|
BAE000
|
heap
|
page read and write
|
||
|
2FE0000
|
heap
|
page read and write
|
||
|
49FE000
|
direct allocation
|
page read and write
|
||
|
5670000
|
trusted library allocation
|
page read and write
|
||
|
2FB0000
|
trusted library allocation
|
page read and write
|
||
|
4061000
|
heap
|
page read and write
|
||
|
A60000
|
heap
|
page read and write
|
||
|
3C40000
|
direct allocation
|
page read and write
|
||
|
2F60000
|
heap
|
page execute and read and write
|
||
|
1085000
|
heap
|
page read and write
|
||
|
4860000
|
direct allocation
|
page read and write
|
||
|
8B4000
|
stack
|
page read and write
|
||
|
5530000
|
trusted library allocation
|
page read and write
|
||
|
DB8000
|
stack
|
page read and write
|
||
|
49FE000
|
direct allocation
|
page read and write
|
||
|
1130000
|
trusted library allocation
|
page read and write
|
||
|
4860000
|
direct allocation
|
page read and write
|
||
|
6B10000
|
trusted library allocation
|
page read and write
|
||
|
4989000
|
direct allocation
|
page read and write
|
||
|
49FE000
|
direct allocation
|
page read and write
|
||
|
2E10000
|
trusted library allocation
|
page read and write
|
||
|
2CC7000
|
trusted library allocation
|
page execute and read and write
|
||
|
4989000
|
direct allocation
|
page read and write
|
||
|
2E60000
|
trusted library allocation
|
page read and write
|
||
|
3E60000
|
heap
|
page read and write
|
||
|
117D000
|
heap
|
page read and write
|
||
|
2CE7000
|
heap
|
page read and write
|
||
|
1170000
|
heap
|
page read and write
|
||
|
46C0000
|
direct allocation
|
page read and write
|
||
|
B7E000
|
heap
|
page read and write
|
||
|
2DF0000
|
trusted library allocation
|
page read and write
|
||
|
3F22000
|
heap
|
page read and write
|
||
|
2CAF000
|
stack
|
page read and write
|
||
|
BAE000
|
heap
|
page read and write
|
||
|
3F3A000
|
heap
|
page read and write
|
||
|
9A000
|
stack
|
page read and write
|
||
|
11ED000
|
heap
|
page read and write
|
||
|
4039000
|
heap
|
page execute and read and write
|
||
|
1123000
|
trusted library allocation
|
page execute and read and write
|
||
|
3C45000
|
heap
|
page read and write
|
||
|
46C0000
|
direct allocation
|
page read and write
|
||
|
555D000
|
trusted library allocation
|
page read and write
|
||
|
1140000
|
heap
|
page read and write
|
||
|
6E0E000
|
stack
|
page read and write
|
||
|
6C57000
|
trusted library allocation
|
page read and write
|
||
|
1100000
|
trusted library allocation
|
page read and write
|
||
|
6C50000
|
trusted library allocation
|
page read and write
|
||
|
498D000
|
direct allocation
|
page read and write
|
||
|
3D60000
|
heap
|
page read and write
|
||
|
6ED0000
|
heap
|
page read and write
|
||
|
113D000
|
trusted library allocation
|
page execute and read and write
|
||
|
59FC000
|
stack
|
page read and write
|
||
|
A15000
|
heap
|
page read and write
|
||
|
6E8F000
|
stack
|
page read and write
|
||
|
B70000
|
heap
|
page read and write
|
||
|
11A2000
|
heap
|
page read and write
|
||
|
6C4E000
|
stack
|
page read and write
|
||
|
4552000
|
heap
|
page read and write
|
||
|
46C0000
|
direct allocation
|
page read and write
|
||
|
72CE000
|
stack
|
page read and write
|
||
|
49FE000
|
direct allocation
|
page read and write
|
||
|
41F2000
|
trusted library allocation
|
page read and write
|
||
|
6B00000
|
trusted library allocation
|
page read and write
|
||
|
498D000
|
direct allocation
|
page read and write
|
||
|
3133000
|
trusted library allocation
|
page read and write
|
||
|
482000
|
unkown
|
page readonly
|
||
|
490000
|
unkown
|
page write copy
|
||
|
482000
|
unkown
|
page readonly
|
||
|
3228000
|
trusted library allocation
|
page read and write
|
||
|
6EA0000
|
trusted library allocation
|
page execute and read and write
|
||
|
2CBA000
|
trusted library allocation
|
page execute and read and write
|
||
|
140F000
|
stack
|
page read and write
|
||
|
5A00000
|
heap
|
page read and write
|
||
|
1124000
|
trusted library allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
3070000
|
heap
|
page read and write
|
||
|
4AB000
|
unkown
|
page readonly
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
6ADE000
|
stack
|
page read and write
|
||
|
2CE0000
|
heap
|
page read and write
|
||
|
498D000
|
direct allocation
|
page read and write
|
||
|
10F0000
|
trusted library section
|
page read and write
|
||
|
3183000
|
trusted library allocation
|
page read and write
|
There are 227 hidden memdumps, click here to show them.