Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Purchase Order PO61000016222.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.335804843769723
Filename:	Purchase Order PO61000016222.exe
Filesize:	1090601
MD5:	11f8530a8aef1f62cb128ba632e26288
SHA1:	0164a8a211523446c4418a0fccb2d04d48cf1ede
SHA256:	199615b403169c65ed2e7257abc0653c5736045ce66c4ccce8466470cf8b4674
SHA512:	b23e8540974d0e2ce67f538bc8e48e1a6627c429cafe537b52e7584e518e79f99bee5d0acbd4dd8291443dfcd2b0c57c2ee8cf278c8c4b3e3f517c9e7bd83323
SSDEEP:	12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QL5b9/VOOK1TekAleXF2EiaDjlX+PaZD:ffmMv6Ckr7Mny5QLZXS5A6F2iD5X+o
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-...i...i...i.....9.k...`.:.w...`.,.....`.+.P...N%..c...N%..H...i...d...`. ./...w.:.k...w.;.h...i.8.h...`.>.h...Richi..........

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection	Disable or Modify Tools
Contains functionality to detect sleep reduction / modifications	Malware Analysis System Evasion
Contains functionality to log keystrokes (.Net Source)	Key, Mouse, Clipboard, Microphone and Screen Capturing
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Switches to a custom stack to bypass stack traces	Malware Analysis System Evasion
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to block mouse and keyboard input (often used to hinder debugging)	Anti Debugging	Disable or Modify Tools
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a window is minimized (may be used to check if an application is visible)	Hooking and other Techniques for Hiding and Protection	Application Window Discovery
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Contains functionality to launch a process as a different user	System Summary	Valid Accounts Native API Access Token Manipulation
Contains functionality to launch a program with higher privileges	HIPS / PFW / Operating System Protection Evasion	Exploitation for Privilege Escalation
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Process Discovery
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection	Disable or Modify Tools
Contains functionality to read the PEB	Anti Debugging
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Contains functionality to shutdown / reboot the system	System Summary	System Shutdown/Reboot
Contains functionality to simulate keystroke presses	HIPS / PFW / Operating System Protection Evasion
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Disable or Modify Tools
Detected potential crypto function	System Summary	System Time Discovery Process Discovery Archive Collected Data Encrypted Channel
Found large amount of non-executed APIs	Malware Analysis System Evasion	System Time Discovery
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information	Disable or Modify Tools System Shutdown/Reboot
PE file contains an invalid checksum	Data Obfuscation
Potential key logger detected (key state polling based)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Disable or Modify Tools
Sample file is different than original file name gathered from version info	System Summary	System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Disable or Modify Tools
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
.NET source code contains calls to encryption/decryption functions	System Summary
Contains functionality for error logging	System Summary	Disable or Modify Tools
Contains functionality to add an ACL to a security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary
Contains functionality to check free disk space	System Summary
Contains functionality to download additional files from the internet	Networking
Contains functionality to enum processes or threads	System Summary	Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to instantiate COM classes	System Summary
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to query local / system time	Language, Device and Operating System Detection
Contains functionality to query system information	Malware Analysis System Evasion	System Information Discovery
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection	Disable or Modify Tools
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion
PE file has an executable .text section and no other executable section	System Summary
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Sample is known by Antivirus	System Summary	Disable or Modify Tools
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading Disable or Modify Tools
Uses an in-process (OLE) Automation server	System Summary
Submission file is bigger than most known malware samples	System Summary	Disable or Modify Tools

C:\Users\user\AppData\Local\Temp\prophetesses

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\prophetesses
Category:	dropped
Dump:	prophetesses.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\Purchase Order PO61000016222.exe
Type:	data
Entropy:	6.501186048703335
Encrypted:	false
Ssdeep:	6144:+pOikF4XdKbPTBzuMIBKaL+YrE7VXtmcMOLWc8K4:VaiTBzoOW9
Size:	240128
Whitelisted:	false
Reputation:	low

Signature Hits	Behavior Group	Mitre Attack
Creates temporary files	System Summary

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\Purchase Order PO61000016222.exe

"C:\Users\user\Desktop\Purchase Order PO61000016222.exe"

Details

Is windows:	false
Is dropped:	false
PID:	7288
Target ID:	0
Parent PID:	2580
Name:	Purchase Order PO61000016222.exe
Path:	C:\Users\user\Desktop\Purchase Order PO61000016222.exe
Commandline:	"C:\Users\user\Desktop\Purchase Order PO61000016222.exe"
Size:	1090601
MD5:	11F8530A8AEF1F62CB128BA632E26288
Time:	01:30:03
Date:	30/10/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x400000
Modulesize:	741376
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Initial sample is a PE file and has a suspicious name	System Summary
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
PE file contains an invalid checksum	Data Obfuscation
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\user\Desktop\Purchase Order PO61000016222.exe"

Details

Is windows:	true
Is dropped:	false
PID:	7320
Target ID:	1
Parent PID:	7288
Name:	RegSvcs.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Commandline:	"C:\Users\user\Desktop\Purchase Order PO61000016222.exe"
Size:	45984
MD5:	9D352BC46709F0CB5EC974633A0C3C94
Time:	01:30:04
Date:	30/10/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0x10000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection

URLs

Name

Malicious

https://api.ipify.org/

104.26.12.205

Details

Name:	https://api.ipify.org/
IP:	104.26.12.205
TargetID:	1
From Memory:	false
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	network

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#

unknown

Details

Name:	http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
TargetID:	1
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000001.00000002.2978442565.0000000005707000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2976741954.000000000243B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2978256868.0000000005677000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2978296078.0000000005699000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://api.ipify.org

unknown

Details

Name:	https://api.ipify.org
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\Purchase Order PO61000016222.exe
Source:	Purchase Order PO61000016222.exe, 00000000.00000002.1758087786.0000000002F50000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2975860410.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2976741954.00000000023C1000.00000004.00000800.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://sectigo.com/CPS0

unknown

Details

Name:	https://sectigo.com/CPS0
TargetID:	1
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000001.00000002.2978442565.0000000005707000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2976741954.000000000243B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2978256868.0000000005677000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2978296078.0000000005699000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://account.dyn.com/

unknown

Details

Name:	https://account.dyn.com/
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\Purchase Order PO61000016222.exe
Source:	Purchase Order PO61000016222.exe, 00000000.00000002.1758087786.0000000002F50000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2975860410.0000000000402000.00000040.80000000.00040000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://api.ipify.org/t

unknown

http://phoenixblowers.com

unknown

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

http://ocsp.sectigo.com05

unknown

Details

Name:	http://ocsp.sectigo.com05
TargetID:	1
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 00000001.00000002.2978442565.0000000005707000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2976741954.000000000243B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2978256868.0000000005677000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2978296078.0000000005699000.00000004.00000020.00020000.00000000.sdmp

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

phoenixblowers.com

43.255.154.55

Details

Name:	phoenixblowers.com
IP:	43.255.154.55
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

api.ipify.org

104.26.12.205

Details

Name:	api.ipify.org
IP:	104.26.12.205
TargetID:	-1
Active:	true

Signature Hits	Behavior Group	Mitre Attack
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

IPs

Domain

Country

Malicious

43.255.154.55

phoenixblowers.com

Singapore

Details

IP:	43.255.154.55
TargetID:	1
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	Singapore
Countrycode:	SGP
ASN number:	26496
ASN name:	AS-26496-GO-DADDY-COM-LLCUS
Private:	false
Domain:	phoenixblowers.com

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol

104.26.12.205

api.ipify.org

United States

Details

IP:	104.26.12.205
TargetID:	1
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	api.ipify.org

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

FileDirectory

There are 5 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

2411000

trusted library allocation

page read and write

402000

system

page execute and read and write

243B000

trusted library allocation

page read and write

2F50000

direct allocation

page read and write

8B4000

stack

page read and write

5A0000

heap

page read and write

41C0000

direct allocation

page read and write

3C41000

heap

page read and write

8CE000

stack

page read and write

43C8000

trusted library allocation

page read and write

9EE000

stack

page read and write

48DC000

stack

page read and write

4C8E000

stack

page read and write

4360000

direct allocation

page read and write

4903000

heap

page read and write

5C10000

trusted library allocation

page read and write

4C4F000

stack

page read and write

42E3000

direct allocation

page read and write

597000

trusted library allocation

page execute and read and write

44FE000

direct allocation

page read and write

65F000

heap

page read and write

4DCD000

stack

page read and write

5707000

heap

page read and write

235B000

trusted library allocation

page read and write

42E3000

direct allocation

page read and write

56D000

trusted library allocation

page execute and read and write

42E3000

direct allocation

page read and write

2E00000

heap

page read and write

44FE000

direct allocation

page read and write

570000

trusted library allocation

page read and write

3E23000

heap

page read and write

5C5D000

stack

page read and write

550000

trusted library allocation

page read and write

A1E000

heap

page read and write

48F0000

heap

page read and write

618000

heap

page read and write

930000

heap

page read and write

2362000

trusted library allocation

page read and write

400000

unkown

page readonly

556E000

stack

page read and write

1AE000

stack

page read and write

120F000

stack

page read and write

A4C000

heap

page read and write

2F44000

heap

page read and write

2356000

trusted library allocation

page read and write

2382000

trusted library allocation

page read and write

236E000

trusted library allocation

page read and write

4489000

direct allocation

page read and write

2E07000

heap

page read and write

5AEE000

stack

page read and write

592000

trusted library allocation

page read and write

5D50000

trusted library allocation

page read and write

3E4A000

heap

page read and write

3EA2000

heap

page read and write

4E8E000

stack

page read and write

4360000

direct allocation

page read and write

A10000

heap

page read and write

563000

trusted library allocation

page execute and read and write

3E1D000

heap

page read and write

36EE000

stack

page read and write

244F000

trusted library allocation

page read and write

4D8F000

stack

page read and write

5D40000

trusted library allocation

page execute and read and write

4900000

heap

page read and write

56E5000

heap

page read and write

23F6000

trusted library allocation

page read and write

448D000

direct allocation

page read and write

4489000

direct allocation

page read and write

59B000

trusted library allocation

page execute and read and write

500000

heap

page read and write

3DCA000

heap

page read and write

5C00000

trusted library allocation

page execute and read and write

90C000

stack

page read and write

42E3000

direct allocation

page read and write

9A000

stack

page read and write

5AAE000

stack

page read and write

3EA1000

heap

page read and write

160000

heap

page read and write

586000

trusted library allocation

page execute and read and write

3E1E000

heap

page execute and read and write

A9000

stack

page read and write

3E1D000

heap

page read and write

2DF0000

heap

page read and write

5CA000

heap

page read and write

41C0000

direct allocation

page read and write

23FF000

trusted library allocation

page read and write

5BF0000

trusted library allocation

page read and write

42E3000

direct allocation

page read and write

41C0000

direct allocation

page read and write

3AEF000

stack

page read and write

450000

heap

page read and write

3D40000

heap

page read and write

5A8000

heap

page read and write

3E1D000

heap

page read and write

4A7000

unkown

page read and write

2F40000

heap

page read and write

63C0000

heap

page read and write

448D000

direct allocation

page read and write

2371000

trusted library allocation

page read and write

4B4E000

stack

page read and write

5CFE000

stack

page read and write

60C7000

trusted library allocation

page read and write

582000

trusted library allocation

page read and write

41C0000

direct allocation

page read and write

3DDE000

heap

page read and write

4E4D000

stack

page read and write

880000

trusted library allocation

page read and write

990000

heap

page read and write

236A000

trusted library allocation

page read and write

448D000

direct allocation

page read and write

58A000

trusted library allocation

page execute and read and write

564000

trusted library allocation

page read and write

A60000

heap

page execute and read and write

5677000

heap

page read and write

60D0000

trusted library allocation

page read and write

60C0000

trusted library allocation

page read and write

694000

heap

page read and write

455E000

stack

page read and write

3FC5000

heap

page read and write

401000

unkown

page execute read

15E000

stack

page read and write

920000

trusted library allocation

page read and write

1A8000

stack

page read and write

44FE000

direct allocation

page read and write

400000

unkown

page readonly

490000

unkown

page read and write

5BE000

heap

page read and write

570C000

heap

page read and write

8AF000

stack

page read and write

44FE000

direct allocation

page read and write

4360000

direct allocation

page read and write

4AB000

unkown

page readonly

4910000

heap

page read and write

5C1C000

trusted library allocation

page read and write

4B0C000

stack

page read and write

4489000

direct allocation

page read and write

1F0000

heap

page read and write

580000

trusted library allocation

page read and write

342B000

trusted library allocation

page read and write

5BF8000

trusted library allocation

page read and write

3CCC000

heap

page read and write

621000

heap

page read and write

89F000

stack

page read and write

2350000

trusted library allocation

page read and write

2FA0000

heap

page read and write

672000

heap

page read and write

AA0000

heap

page read and write

41C0000

direct allocation

page read and write

A40000

trusted library allocation

page read and write

23A0000

heap

page execute and read and write

3EA1000

heap

page read and write

A70000

trusted library allocation

page read and write

41C0000

direct allocation

page read and write

910000

trusted library allocation

page execute and read and write

59AF000

stack

page read and write

5D8000

heap

page read and write

5D5000

heap

page read and write

3CAD000

heap

page read and write

67E000

heap

page read and write

23C1000

trusted library allocation

page read and write

4AB000

unkown

page readonly

682000

heap

page read and write

448D000

direct allocation

page read and write

400000

system

page execute and read and write

5BEF000

stack

page read and write

33E9000

trusted library allocation

page read and write

520000

heap

page read and write

401000

unkown

page execute read

23B0000

heap

page read and write

3DE2000

heap

page read and write

60E0000

trusted library allocation

page read and write

4360000

direct allocation

page read and write

3AF9000

heap

page read and write

2376000

trusted library allocation

page read and write

3C40000

heap

page read and write

448D000

direct allocation

page read and write

234F000

stack

page read and write

5699000

heap

page read and write

AA6000

heap

page read and write

A1A000

heap

page read and write

110000

heap

page read and write

5C60000

trusted library allocation

page read and write

100000

heap

page read and write

240D000

trusted library allocation

page read and write

4360000

direct allocation

page read and write

6110000

heap

page read and write

4A0000

heap

page read and write

A50000

trusted library allocation

page read and write

409B000

heap

page read and write

2F20000

heap

page read and write

5670000

heap

page read and write

4489000

direct allocation

page read and write

2FA5000

heap

page read and write

482000

unkown

page readonly

525000

heap

page read and write

42E3000

direct allocation

page read and write

1C0000

heap

page read and write

44FE000

direct allocation

page read and write

33C1000

trusted library allocation

page read and write

560000

trusted library allocation

page read and write

44FE000

direct allocation

page read and write

235E000

trusted library allocation

page read and write

57D000

trusted library allocation

page execute and read and write

6120000

trusted library allocation

page execute and read and write

448D000

direct allocation

page read and write

237D000

trusted library allocation

page read and write

2DEE000

stack

page read and write

482000

unkown

page readonly

4489000

direct allocation

page read and write

165000

heap

page read and write

160E000

stack

page read and write

4489000

direct allocation

page read and write

571F000

heap

page read and write

2437000

trusted library allocation

page read and write

2439000

trusted library allocation

page read and write

5C67000

trusted library allocation

page read and write

4360000

direct allocation

page read and write

490000

unkown

page write copy

595000

trusted library allocation

page execute and read and write

There are 209 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Purchase Order PO61000016222.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportPurchase Order PO61000016222.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
Purchase Order PO61000016222.exe