Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

018292540-LetterReguranPPI-20230814215304.PDF.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.891244361216534
Filename:	018292540-LetterReguranPPI-20230814215304.PDF.exe
Filesize:	918528
MD5:	667060459d876845db2677ddc3d58488
SHA1:	800f741383f4f4027d70a5942fe4b263b592eed5
SHA256:	3e080ccb41529931481861828df6a2ca32b039ed0217adcecb832547d8da0566
SHA512:	c9fce460c1b2de0e53782df4a84dc6c1d28bc4b8b8850b0adcbf3f87e72d156654760ebb32e52582a7adc4e3d58526959b51cdfd72fa947b314749c23492fee7
SSDEEP:	24576:vMy1GyhxutkS+BwTCEGh0BV0i7OqD4uTfV:LFhxutkdeCEGmB6uD4uD
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ... ....@.. .......................`............@................................

Signature Hits	Behavior Group	Mitre Attack
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
.NET source code contains potential unpacker	Data Obfuscation	Access Token Manipulation
Contains functionality to register a low level keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Disable or Modify Tools
Contains functionality to steal Chrome passwords or cookies	Stealing of Sensitive Information	OS Credential Dumping Account Discovery System Owner/User Discovery
Contains functionality to steal Firefox passwords or cookies	Stealing of Sensitive Information	Access Token Manipulation Credentials In Files
Contains functionalty to change the wallpaper	Spam, unwanted Advertisements and Ransom Demands	Defacement
Delayed program exit found	Malware Analysis System Evasion	Access Token Manipulation Process Discovery
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation
Machine Learning detection for sample	AV Detection
Abnormal high CPU Usage	System Summary	Access Token Manipulation Process Injection System Time Discovery
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion	Security Software Discovery
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to download and launch executables	Persistence and Installation Behavior	Access Token Manipulation Process Discovery
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)	HIPS / PFW / Operating System Protection Evasion	Access Token Manipulation
Contains functionality to enumerate running services	Malware Analysis System Evasion	System Service Discovery
Contains functionality to launch a control a shell (cmd.exe)	Remote Access Functionality	Command and Scripting Interpreter Access Token Manipulation Account Discovery System Owner/User Discovery
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Access Token Manipulation Process Discovery Clipboard Data
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection	System Information Discovery
Contains functionality to query locales information (e.g. system language)	Language, Device and Operating System Detection	Access Token Manipulation System Shutdown/Reboot
Contains functionality to read the PEB	Anti Debugging	Access Token Manipulation
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	Access Token Manipulation System Shutdown/Reboot
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion	Masquerading
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	File and Directory Discovery
Detected potential crypto function	System Summary	Access Token Manipulation Process Discovery Archive Collected Data Encrypted Channel
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
Found potential string decryption / allocating functions	System Summary	Deobfuscate/Decode Files or Information
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	Native API
Sample file is different than original file name gathered from version info	System Summary	Access Token Manipulation System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses Microsoft's Enhanced Cryptographic Provider	Cryptography
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Yara signature match	System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary
.NET source code contains many API calls related to security	System Summary	Disable or Modify Tools
.NET source code contains many randomly named methods	Data Obfuscation	Disable or Modify Tools
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary	Access Token Manipulation
Contains functionality to download additional files from the internet	Networking
Contains functionality to enum processes or threads	System Summary	Access Token Manipulation Process Discovery
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to modify services (start/stop/modify)	System Summary	Service Execution Windows Service Access Token Manipulation System Time Discovery
Contains functionality to query local / system time	Language, Device and Operating System Detection	Access Token Manipulation System Time Discovery
Contains functionality to query local drives	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection	Access Token Manipulation
Contains functionality to register its own exception handler	Anti Debugging
Contains functionality to start windows services	Boot Survival	Access Token Manipulation
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion	Virtualization/Sandbox Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse engineering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary	Access Token Manipulation
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
PE file has an executable .text section and no other executable section	System Summary	Access Token Manipulation
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Program exit points	Malware Analysis System Evasion
Public key (encryption) found	Cryptography	Account Discovery System Owner/User Discovery
Queries the cryptographic machine GUID	Language, Device and Operating System Detection	Access Token Manipulation
Reads software policies	System Summary	Access Token Manipulation
Sample is known by Antivirus	System Summary	Access Token Manipulation
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary	Access Token Manipulation
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary	Access Token Manipulation

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\018292540-LetterReguranPPI-20230814215304.PDF.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\018292540-LetterReguranPPI-20230814215304.PDF.exe.log
Category:	dropped
Dump:	018292540-LetterReguranPPI-20230814215304.PDF.exe.log.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.34331486778365
Encrypted:	false
Ssdeep:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
Size:	1216
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Machine Learning detection for sample	AV Detection
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\ProgramData\pdf\logs.dat

data

dropped

Details

File:	C:\ProgramData\pdf\logs.dat
Category:	dropped
Dump:	logs.dat.3.dr
ID:	dr_1
Target ID:	3
Process:	C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe
Type:	data
Entropy:	6.687218230578943
Encrypted:	false
Ssdeep:	3:UT3Al0w0z8pypcu9AHYLf5UJg//LLnzQ3Zaw+3L:U7Auh8o1A4LmgjLhX
Size:	144
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json

JSON data

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json
Category:	dropped
Dump:	json[1].json.3.dr
ID:	dr_2
Target ID:	3
Process:	C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe
Type:	JSON data
Entropy:	5.01442467270497
Encrypted:	false
Ssdeep:	12:tkluQ+nd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkwV:qluQydVauKyGX85jvXhNlT3/7AcV9Wro
Size:	962
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe

"C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe"

Details

Is windows:	false
Is dropped:	false
PID:	1224
Target ID:	0
Parent PID:	1028
Name:	018292540-LetterReguranPPI-20230814215304.PDF.exe
Path:	C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe
Commandline:	"C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe"
Size:	918528
MD5:	667060459D876845DB2677DDC3D58488
Time:	08:17:05
Date:	22/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xdb0000
Modulesize:	942080
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Suspicious Double Extension File Execution	System Summary
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Initial sample is a PE file and has a suspicious name	System Summary
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Uses an obfuscated file name to hide its real file extension (double extension)	Hooking and other Techniques for Hiding and Protection	Masquerading Obfuscated Files or Information
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe

"C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe"

Details

Is windows:	false
Is dropped:	false
PID:	6380
Target ID:	3
Parent PID:	1224
Name:	018292540-LetterReguranPPI-20230814215304.PDF.exe
Path:	C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe
Commandline:	"C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe"
Size:	918528
MD5:	667060459D876845DB2677DDC3D58488
Time:	08:17:07
Date:	22/11/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xb00000
Modulesize:	942080
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Sigma detected: Suspicious Double Extension File Execution	System Summary
Yara detected AntiVM3	Malware Analysis System Evasion
Yara detected Remcos RAT	AV Detection, E-Banking Fraud, Stealing of Sensitive Information, Remote Access Functionality
Initial sample is a PE file and has a suspicious name	System Summary
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Installs a global keyboard hook	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Machine Learning detection for sample	AV Detection
Uses an obfuscated file name to hide its real file extension (double extension)	Hooking and other Techniques for Hiding and Protection	Masquerading Obfuscated Files or Information
Binary contains a suspicious time stamp	Data Obfuscation	Timestomp
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

URLs

Name

Malicious

oyo.work.gd

Details

Name:	oyo.work.gd
TargetID:	0
From Memory:	false
Current Path:	C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe
Source:	config extractor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

http://geoplugin.net/json.gp

178.237.33.50

Details

Name:	http://geoplugin.net/json.gp
IP:	178.237.33.50
TargetID:	3
From Memory:	false
Current Path:	C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
Suricata IDS alerts with low severity for network traffic	Networking
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gp/C

unknown

Details

Name:	http://geoplugin.net/json.gp/C
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe
Source:	018292540-LetterReguranPPI-20230814215304.PDF.exe, 00000000.00000002.2121163899.0000000004CD7000.00000004.00000800.00020000.00000000.sdmp, 018292540-LetterReguranPPI-20230814215304.PDF.exe, 00000000.00000002.2121163899.00000000041D9000.00000004.00000800.00020000.00000000.sdmp, 018292540-LetterReguranPPI-20230814215304.PDF.exe, 00000003.00000002.4563140092.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://geoplugin.net/json.gpl

unknown

Details

Name:	http://geoplugin.net/json.gpl
TargetID:	3
From Memory:	true
Current Path:	C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe
Source:	018292540-LetterReguranPPI-20230814215304.PDF.exe, 00000003.00000002.4563667041.00000000011B6000.00000004.00000020.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

geoplugin.net

178.237.33.50

Details

Name:	geoplugin.net
IP:	178.237.33.50
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
HTTP GET or POST without a user agent	Networking
Suricata IDS alerts with low severity for network traffic	Networking
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking

oyo.work.gd

154.216.20.185

Details

Name:	oyo.work.gd
IP:	154.216.20.185
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
Suricata IDS alerts for network traffic	Networking
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol

IPs

Domain

Country

Malicious

178.237.33.50

geoplugin.net

Netherlands

Details

IP:	178.237.33.50
TargetID:	3
Current Path:	C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe
Country:	Netherlands
Countrycode:	NLD
ASN number:	8455
ASN name:	ATOM86-ASATOM86NL
Private:	false
Domain:	geoplugin.net

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts with low severity for network traffic	Networking

154.216.20.185

oyo.work.gd

Seychelles

Details

IP:	154.216.20.185
TargetID:	3
Current Path:	C:\Users\user\Desktop\018292540-LetterReguranPPI-20230814215304.PDF.exe
Country:	Seychelles
Countrycode:	SYC
ASN number:	135357
ASN name:	SKHT-ASShenzhenKatherineHengTechnologyInformationCo
Private:	false
Domain:	oyo.work.gd

Signature Hits	Behavior Group	Mitre Attack
Suricata IDS alerts for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port

Registry

Path

Value

Malicious

HKEY_CURRENT_USER\SOFTWARE\jkm-I9KENP

exepath

HKEY_CURRENT_USER\SOFTWARE\jkm-I9KENP

licence

Memdumps

Base Address

Regiontype

Protect

Malicious

400000

remote allocation

page execute and read and write

117A000

heap

page read and write

4CD7000

trusted library allocation

page read and write

41D9000

trusted library allocation

page read and write

3B2E000

stack

page read and write

1592000

trusted library allocation

page read and write

5636000

trusted library allocation

page read and write

5B80000

heap

page read and write

1368000

heap

page read and write

5700000

trusted library allocation

page read and write

5740000

trusted library allocation

page read and write

157D000

trusted library allocation

page execute and read and write

5660000

trusted library allocation

page read and write

159B000

trusted library allocation

page execute and read and write

1348000

heap

page read and write

5900000

trusted library allocation

page read and write

56F3000

heap

page read and write

11D5000

heap

page read and write

562E000

trusted library allocation

page read and write

F90000

heap

page read and write

73A0000

trusted library allocation

page read and write

5610000

trusted library allocation

page read and write

56F0000

heap

page read and write

73FE000

trusted library allocation

page read and write

561B000

trusted library allocation

page read and write

158A000

trusted library allocation

page execute and read and write

B98E000

stack

page read and write

31D1000

trusted library allocation

page read and write

5B50000

trusted library allocation

page execute and read and write

1380000

heap

page read and write

316F000

stack

page read and write

181F000

stack

page read and write

BB8E000

stack

page read and write

1423000

heap

page read and write

73EE000

stack

page read and write

1457000

heap

page read and write

58D0000

heap

page read and write

11DC000

heap

page read and write

7360000

trusted library allocation

page read and write

475000

remote allocation

page execute and read and write

914E000

stack

page read and write

13E3000

heap

page read and write

1564000

trusted library allocation

page read and write

563D000

trusted library allocation

page read and write

FF0000

heap

page read and write

5910000

trusted library allocation

page read and write

1590000

trusted library allocation

page read and write

BD8F000

stack

page read and write

924E000

stack

page read and write

13DB000

heap

page read and write

15B0000

trusted library allocation

page read and write

784E000

stack

page read and write

BE8F000

stack

page read and write

11C3000

heap

page read and write

2DEC000

stack

page read and write

1582000

trusted library allocation

page read and write

B9CE000

stack

page read and write

9010000

heap

page read and write

302F000

stack

page read and write

2EEF000

stack

page read and write

5B75000

heap

page read and write

11A6000

heap

page read and write

58E0000

heap

page read and write

1600000

trusted library allocation

page execute and read and write

5631000

trusted library allocation

page read and write

F7C000

stack

page read and write

31AE000

stack

page read and write

579B000

stack

page read and write

E7C000

stack

page read and write

2C60000

heap

page read and write

5840000

trusted library section

page readonly

7260000

heap

page read and write

73F5000

trusted library allocation

page read and write

56A0000

trusted library allocation

page read and write

5680000

trusted library allocation

page read and write

2F2C000

stack

page read and write

5640000

trusted library allocation

page read and write

3258000

trusted library allocation

page read and write

73F0000

trusted library allocation

page read and write

5702000

trusted library allocation

page read and write

5920000

heap

page execute and read and write

1411000

heap

page read and write

156D000

trusted library allocation

page execute and read and write

1167000

heap

page read and write

904C000

heap

page read and write

471000

remote allocation

page execute and read and write

1450000

heap

page read and write

5650000

trusted library allocation

page read and write

5675000

trusted library allocation

page read and write

52CC000

stack

page read and write

9047000

heap

page read and write

5BB0000

heap

page read and write

306E000

stack

page read and write

5A40000

heap

page read and write

1573000

trusted library allocation

page read and write

1480000

heap

page read and write

5CA0000

trusted library allocation

page execute and read and write

5720000

trusted library allocation

page execute and read and write

1470000

trusted library allocation

page read and write

5B90000

heap

page read and write

934E000

stack

page read and write

1160000

heap

page read and write

1597000

trusted library allocation

page execute and read and write

5642000

trusted library allocation

page read and write

FA0000

heap

page read and write

7740000

trusted library section

page read and write

1580000

trusted library allocation

page read and write

133E000

stack

page read and write

1610000

heap

page read and write

1563000

trusted library allocation

page execute and read and write

5C90000

trusted library allocation

page execute and read and write

2CAE000

stack

page read and write

FC0000

heap

page read and write

5670000

trusted library allocation

page read and write

1570000

trusted library allocation

page read and write

5614000

trusted library allocation

page read and write

5B4D000

stack

page read and write

1586000

trusted library allocation

page execute and read and write

5710000

trusted library allocation

page execute and read and write

2FFC000

stack

page read and write

13EC000

heap

page read and write

3028000

trusted library allocation

page read and write

3C2F000

stack

page read and write

12F7000

stack

page read and write

1382000

heap

page read and write

32AF000

stack

page read and write

5C80000

trusted library section

page read and write

FEE000

stack

page read and write

F2A000

stack

page read and write

3010000

heap

page read and write

56E0000

heap

page read and write

32D0000

trusted library allocation

page read and write

41D1000

trusted library allocation

page read and write

58F0000

trusted library allocation

page read and write

5B70000

heap

page read and write

7962000

trusted library allocation

page read and write

15FE000

stack

page read and write

134E000

heap

page read and write

30C0000

heap

page execute and read and write

726E000

heap

page read and write

1560000

trusted library allocation

page read and write

1110000

heap

page read and write

BC8F000

stack

page read and write

2DAF000

stack

page read and write

743E000

stack

page read and write

3246000

trusted library allocation

page read and write

DB0000

unkown

page readonly

11B6000

heap

page read and write

31CE000

stack

page read and write

3000000

trusted library allocation

page read and write

DB2000

unkown

page readonly

171F000

stack

page read and write

1340000

heap

page read and write

There are 143 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
018292540-LetterReguranPPI-20230814215304.PDF.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report018292540-LetterReguranPPI-20230814215304.PDF.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
018292540-LetterReguranPPI-20230814215304.PDF.exe