IOC Report
MV. NORDRHONE VSL's PARTICULARS.xlsx.exe

loading gif

Files

File Path
Type
Category
Malicious
MV. NORDRHONE VSL's PARTICULARS.xlsx.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\gobioid
data
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\MV. NORDRHONE VSL's PARTICULARS.xlsx.exe
"C:\Users\user\Desktop\MV. NORDRHONE VSL's PARTICULARS.xlsx.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\MV. NORDRHONE VSL's PARTICULARS.xlsx.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
unknown
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
http://i.pki.goog/gsr1.crt0-
unknown
http://c.pki.goog/r/r4.crl0
unknown
http://i.pki.goog/we1.crt0
unknown
http://c.pki.goog/we1/fJedmL2peto.crl0
unknown
http://c.pki.goog/r/gsr1.crl0
unknown
http://i.pki.goog/r4.crt0
unknown
https://api.ipify.org/t
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://beirutrest.com
unknown
http://o.pki.goog/s/we1/Rk80%
unknown
There are 3 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
beirutrest.com
50.87.144.157
 malicious
api.ipify.org
104.26.13.205

IPs

IP
Domain
Country
Malicious
50.87.144.157
beirutrest.com
United States
malicious
104.26.13.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
4FF0000
trusted library section
page read and write
 malicious
3B21000
trusted library allocation
page read and write
 malicious
2B97000
trusted library allocation
page read and write
 malicious
277E000
heap
page read and write
 malicious
4F60000
trusted library section
page read and write
 malicious
2B6E000
trusted library allocation
page read and write
 malicious
8FE000
stack
page read and write
6850000
trusted library allocation
page read and write
3E62000
heap
page read and write
4453000
direct allocation
page read and write
9F0000
heap
page read and write
4FB0000
trusted library allocation
page read and write
ABA000
heap
page read and write
64C0000
trusted library allocation
page read and write
3E3B000
heap
page read and write
6620000
trusted library allocation
page read and write
100000
heap
page read and write
B2F000
heap
page read and write
479D000
direct allocation
page read and write
3EB0000
heap
page read and write
4330000
direct allocation
page read and write
4453000
direct allocation
page read and write
4FD1000
trusted library allocation
page read and write
4FD6000
trusted library allocation
page read and write
3D30000
heap
page read and write
2584000
trusted library allocation
page read and write
2B5D000
trusted library allocation
page read and write
4670000
direct allocation
page read and write
2583000
trusted library allocation
page execute and read and write
3DD4000
heap
page read and write
3E2D000
heap
page read and write
4FCE000
trusted library allocation
page read and write
2500000
trusted library section
page read and write
3EB1000
heap
page read and write
4FBB000
trusted library allocation
page read and write
289E000
stack
page read and write
529C000
stack
page read and write
2560000
trusted library section
page read and write
4453000
direct allocation
page read and write
2570000
trusted library allocation
page read and write
4799000
direct allocation
page read and write
479D000
direct allocation
page read and write
5040000
heap
page execute and read and write
653D000
stack
page read and write
2580000
trusted library allocation
page read and write
A4E000
stack
page read and write
2B9D000
trusted library allocation
page read and write
2720000
heap
page execute and read and write
3DEC000
heap
page read and write
377E000
stack
page read and write
490000
unkown
page write copy
482000
unkown
page readonly
26CB000
trusted library allocation
page execute and read and write
2510000
heap
page read and write
3DF7000
heap
page read and write
3B7F000
stack
page read and write
24E0000
heap
page read and write
4FBE000
trusted library allocation
page read and write
3030000
heap
page read and write
444000
system
page execute and read and write
4670000
direct allocation
page read and write
400000
unkown
page readonly
4330000
direct allocation
page read and write
6610000
trusted library allocation
page read and write
6BFE000
stack
page read and write
5DB0000
heap
page read and write
480E000
direct allocation
page read and write
426000
system
page execute and read and write
D20000
heap
page read and write
5DF2000
heap
page read and write
26C2000
trusted library allocation
page read and write
64F0000
trusted library allocation
page read and write
4C1D000
stack
page read and write
4FCA000
trusted library allocation
page read and write
67CE000
stack
page read and write
479D000
direct allocation
page read and write
64C8000
trusted library allocation
page read and write
2B1F000
stack
page read and write
25A0000
heap
page read and write
93E000
stack
page read and write
26E0000
trusted library allocation
page read and write
660E000
stack
page read and write
9DE000
stack
page read and write
3EA1000
heap
page read and write
4453000
direct allocation
page read and write
2750000
heap
page read and write
A7F000
heap
page read and write
26BA000
trusted library allocation
page execute and read and write
3DC6000
heap
page read and write
A40000
heap
page read and write
A05000
heap
page read and write
400000
unkown
page readonly
258D000
trusted library allocation
page execute and read and write
980000
heap
page read and write
482000
unkown
page readonly
480E000
direct allocation
page read and write
2928000
trusted library allocation
page read and write
60C0000
heap
page read and write
3F31000
heap
page read and write
B43000
heap
page read and write
3034000
heap
page read and write
6617000
trusted library allocation
page read and write
3C30000
heap
page read and write
ABA000
heap
page read and write
A00000
heap
page read and write
4799000
direct allocation
page read and write
2A00000
trusted library allocation
page read and write
479D000
direct allocation
page read and write
479D000
direct allocation
page read and write
4799000
direct allocation
page read and write
5E3E000
heap
page read and write
5E6A000
heap
page read and write
4330000
direct allocation
page read and write
2E53000
heap
page read and write
3F31000
heap
page read and write
7F5D0000
trusted library allocation
page execute and read and write
3EA2000
heap
page execute and read and write
3E96000
heap
page read and write
5E52000
heap
page read and write
6860000
trusted library allocation
page execute and read and write
2B95000
trusted library allocation
page read and write
AB0000
heap
page read and write
259D000
trusted library allocation
page execute and read and write
2FC0000
direct allocation
page read and write
3F7A000
heap
page read and write
54BE000
unkown
page read and write
2700000
trusted library allocation
page read and write
A89000
heap
page read and write
950000
heap
page read and write
64E0000
trusted library allocation
page execute and read and write
28E0000
trusted library allocation
page read and write
26B6000
trusted library allocation
page execute and read and write
2740000
trusted library allocation
page read and write
A00000
heap
page read and write
ABE000
heap
page read and write
26C0000
trusted library allocation
page read and write
3C23000
trusted library allocation
page read and write
12AE000
stack
page read and write
2B21000
trusted library allocation
page read and write
4AB000
unkown
page readonly
3E07000
heap
page read and write
2B93000
trusted library allocation
page read and write
4453000
direct allocation
page read and write
AFA000
heap
page read and write
A90000
heap
page read and write
3BE2000
trusted library allocation
page read and write
4453000
direct allocation
page read and write
2BAB000
trusted library allocation
page read and write
AEB000
heap
page read and write
4330000
direct allocation
page read and write
3EA7000
heap
page read and write
3DFD000
heap
page read and write
4330000
direct allocation
page read and write
4670000
direct allocation
page read and write
89F000
stack
page read and write
64D4000
trusted library allocation
page read and write
2A10000
heap
page read and write
105000
heap
page read and write
60B0000
trusted library allocation
page read and write
4799000
direct allocation
page read and write
8AF000
stack
page read and write
266E000
stack
page read and write
1F0000
heap
page read and write
4799000
direct allocation
page read and write
110000
heap
page read and write
255E000
stack
page read and write
480E000
direct allocation
page read and write
4FDD000
trusted library allocation
page read and write
479D000
direct allocation
page read and write
6AFE000
stack
page read and write
88A000
stack
page read and write
4FB6000
trusted library allocation
page read and write
A05000
heap
page read and write
60D0000
trusted library allocation
page execute and read and write
6890000
heap
page read and write
26C5000
trusted library allocation
page execute and read and write
5E20000
heap
page read and write
988000
stack
page read and write
A8E000
stack
page read and write
64D0000
trusted library allocation
page read and write
9A000
stack
page read and write
28DC000
stack
page read and write
2B54000
trusted library allocation
page read and write
5160000
heap
page read and write
44F7000
heap
page read and write
AC3000
heap
page read and write
3E49000
heap
page read and write
2590000
trusted library allocation
page read and write
26C7000
trusted library allocation
page execute and read and write
3F7A000
heap
page read and write
26B0000
trusted library allocation
page read and write
480E000
direct allocation
page read and write
A50000
heap
page read and write
2753000
heap
page read and write
2593000
trusted library allocation
page read and write
3DF9000
heap
page read and write
5DB8000
heap
page read and write
480E000
direct allocation
page read and write
4AB000
unkown
page readonly
433D000
heap
page read and write
4FC2000
trusted library allocation
page read and write
5FAE000
stack
page read and write
60BD000
trusted library allocation
page read and write
3EB1000
heap
page read and write
6AB0000
heap
page read and write
D1E000
stack
page read and write
401000
unkown
page execute read
8B4000
stack
page read and write
4670000
direct allocation
page read and write
4670000
direct allocation
page read and write
490000
unkown
page read and write
3EA3000
heap
page read and write
43F6000
heap
page read and write
2517000
heap
page read and write
480E000
direct allocation
page read and write
A8C000
heap
page read and write
4A7000
unkown
page read and write
539C000
stack
page read and write
29FE000
stack
page read and write
AE3000
heap
page read and write
625D000
stack
page read and write
3F30000
heap
page read and write
4670000
direct allocation
page read and write
2B6A000
trusted library allocation
page read and write
AEA000
heap
page read and write
401000
unkown
page execute read
3B8E000
heap
page read and write
635E000
stack
page read and write
16AF000
stack
page read and write
AEA000
heap
page read and write
25EE000
stack
page read and write
65CE000
stack
page read and write
4330000
direct allocation
page read and write
A58000
heap
page read and write
3DD7000
heap
page read and write
26F0000
trusted library allocation
page execute and read and write
400000
system
page execute and read and write
514E000
stack
page read and write
4799000
direct allocation
page read and write
3EA0000
heap
page read and write
2730000
trusted library allocation
page read and write
26B2000
trusted library allocation
page read and write
649D000
stack
page read and write
262E000
stack
page read and write
639E000
stack
page read and write
2910000
heap
page read and write
There are 236 hidden memdumps, click here to show them.