Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Cleared Payment.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy:	7.938263954989257
Filename:	Cleared Payment.exe
Filesize:	767488
MD5:	0df9817e2867f94e6bf0c066f9d88013
SHA1:	9b45f5c8cf5402b8cd56b58df316ca84b633f5c2
SHA256:	ff70339ef950407a12f181c63d5b3d59fe40198237d97ce3c6537403c7863624
SHA512:	f14ad10b0378351739effc439c3967f0bf41ccca9a45f3ad438582a03a806bd44945b858c68ad35283d39787be4bc078ed5939005f38af9dec0b32dd3ab9806e
SSDEEP:	12288:qJiNBSErx60+7FKlMglO7kMSd1CjKaXJt9Fh5bvo8nkLtU45M1z:+iNwErJuoMSOGk750FtHO
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..............0.................. ... ....@.. ....................... ............`................................

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Found malware configuration	AV Detection
Malicious sample detected (through community Yara rule)	System Summary
Multi AV Scanner detection for submitted file	AV Detection
.NET source code contains potential unpacker	Data Obfuscation
.NET source code contains very large array initializations	System Summary	Disable or Modify Tools
Contains functionality to log keystrokes (.Net Source)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion
Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)	Malware Analysis System Evasion	Windows Management Instrumentation Virtualization/Sandbox Evasion Security Software Discovery
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)	Stealing of Sensitive Information	Credentials in Registry
Tries to harvest and steal browser information (history, passwords, etc)	Stealing of Sensitive Information	OS Credential Dumping Data from Local System
Tries to steal Mail credentials (via file / registry access)	Stealing of Sensitive Information	Email Collection
Allocates memory with a write watch (potentially for evading sandboxes)	Malware Analysis System Evasion
Contains long sleeps (>= 3 min)	Malware Analysis System Evasion
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Archive Collected Data Encrypted Channel
Enables debug privileges	Anti Debugging
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)	Malware Analysis System Evasion
May sleep (evasive loops) to hinder dynamic analysis	Malware Analysis System Evasion
Monitors certain registry keys / values for changes (often done to protect autostart functionality)	Hooking and other Techniques for Hiding and Protection	Query Registry
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)	Malware Analysis System Evasion
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)	Malware Analysis System Evasion
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary	Masquerading
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation	Obfuscated Files or Information
Yara signature match	System Summary
Binary may include packed or encrypted code	Data Obfuscation	Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary
.NET source code contains calls to encryption/decryption functions	System Summary	Disable or Modify Tools Deobfuscate/Decode Files or Information
.NET source code contains many API calls related to security	System Summary	Disable or Modify Tools
.NET source code contains many randomly named methods	Data Obfuscation	Disable or Modify Tools
Contains medium sleeps (>= 30s)	Malware Analysis System Evasion
Creates files inside the user directory	System Summary	Masquerading
Creates guard pages, often used to prevent reverse usering and debugging	Anti Debugging	Disable or Modify Tools
Creates mutexes	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)	Malware Analysis System Evasion
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Queries a list of all running processes	Malware Analysis System Evasion	Process Discovery
Queries process information (via WMI, Win32_Process)	System Summary
Queries the cryptographic machine GUID	Language, Device and Operating System Detection
Reads ini files	System Summary	File and Directory Discovery
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
URLs found in memory or binary data	Networking
Uses an in-process (OLE) Automation server	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
Checks if Microsoft Office is installed	System Summary	System Information Discovery
PE file contains a COM descriptor data directory	System Summary
Uses Microsoft Silverlight	System Summary

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Cleared Payment.exe.log

ASCII text, with CRLF line terminators

dropped

Details

File:	C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Cleared Payment.exe.log
Category:	dropped
Dump:	Cleared Payment.exe.log.0.dr
ID:	dr_0
Target ID:	0
Process:	C:\Users\user\Desktop\Cleared Payment.exe
Type:	ASCII text, with CRLF line terminators
Entropy:	5.34331486778365
Encrypted:	false
Ssdeep:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
Size:	1216
Whitelisted:	false
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\Cleared Payment.exe

"C:\Users\user\Desktop\Cleared Payment.exe"

Details

Is windows:	false
Is dropped:	false
PID:	5140
Target ID:	0
Parent PID:	4004
Name:	Cleared Payment.exe
Path:	C:\Users\user\Desktop\Cleared Payment.exe
Commandline:	"C:\Users\user\Desktop\Cleared Payment.exe"
Size:	767488
MD5:	0DF9817E2867F94E6BF0C066F9D88013
Time:	08:35:53
Date:	17/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x220000
Modulesize:	794624
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Initial sample is a PE file and has a suspicious name	System Summary
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected Generic Downloader	Networking
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\Cleared Payment.exe

"C:\Users\user\Desktop\Cleared Payment.exe"

Details

Is windows:	false
Is dropped:	false
PID:	1524
Target ID:	3
Parent PID:	5140
Name:	Cleared Payment.exe
Path:	C:\Users\user\Desktop\Cleared Payment.exe
Commandline:	"C:\Users\user\Desktop\Cleared Payment.exe"
Size:	767488
MD5:	0DF9817E2867F94E6BF0C066F9D88013
Time:	08:35:54
Date:	17/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x1a0000
Modulesize:	794624
Wow64:	false

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Initial sample is a PE file and has a suspicious name	System Summary
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected Generic Downloader	Networking
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

C:\Users\user\Desktop\Cleared Payment.exe

"C:\Users\user\Desktop\Cleared Payment.exe"

Details

Is windows:	false
Is dropped:	false
PID:	2548
Target ID:	4
Parent PID:	5140
Name:	Cleared Payment.exe
Path:	C:\Users\user\Desktop\Cleared Payment.exe
Commandline:	"C:\Users\user\Desktop\Cleared Payment.exe"
Size:	767488
MD5:	0DF9817E2867F94E6BF0C066F9D88013
Time:	08:35:54
Date:	17/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0xb00000
Modulesize:	794624
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Antivirus / Scanner detection for submitted sample	AV Detection
Multi AV Scanner detection for submitted file	AV Detection
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Initial sample is a PE file and has a suspicious name	System Summary
Injects a PE file into a foreign processes	HIPS / PFW / Operating System Protection Evasion	Process Injection
Yara detected Generic Downloader	Networking
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Queries the volume information (name, serial number etc) of a device	Language, Device and Operating System Detection	System Information Discovery
Sample file is different than original file name gathered from version info	System Summary
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses 32bit PE files	Compliance, System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Binary may include packed or encrypted code	Data Obfuscation	Obfuscated Files or Information Software Packing
PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)	System Summary	Software Packing
Creates files inside the user directory	System Summary	Masquerading
PE file has an executable .text section and no other executable section	System Summary
Parts of this applications are using the .NET runtime (Probably coded in C#)	System Summary
Sample is known by Antivirus	System Summary
Sample reads its own file content	System Summary
Spawns processes	System Summary	Process Injection
Contains modern PE file flags such as dynamic base (ASLR) or NX	Compliance, System Summary
PE file contains a COM descriptor data directory	System Summary

URLs

Name

Malicious

https://api.ipify.org/

104.26.13.205

Details

Name:	https://api.ipify.org/
IP:	104.26.13.205
TargetID:	4
From Memory:	false
Current Path:	C:\Users\user\Desktop\Cleared Payment.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

https://api.ipify.org

unknown

Details

Name:	https://api.ipify.org
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\Cleared Payment.exe
Source:	Cleared Payment.exe, 00000000.00000002.2110434279.0000000003832000.00000004.00000800.00020000.00000000.sdmp, Cleared Payment.exe, 00000000.00000002.2110434279.00000000041D1000.00000004.00000800.00020000.00000000.sdmp, Cleared Payment.exe, 00000000.00000002.2110434279.000000000374E000.00000004.00000800.00020000.00000000.sdmp, Cleared Payment.exe, 00000004.00000002.3323797943.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Cleared Payment.exe, 00000004.00000002.3325617856.0000000002D81000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://account.dyn.com/

unknown

Details

Name:	https://account.dyn.com/
TargetID:	0
From Memory:	true
Current Path:	C:\Users\user\Desktop\Cleared Payment.exe
Source:	Cleared Payment.exe, 00000000.00000002.2110434279.0000000003832000.00000004.00000800.00020000.00000000.sdmp, Cleared Payment.exe, 00000000.00000002.2110434279.00000000041D1000.00000004.00000800.00020000.00000000.sdmp, Cleared Payment.exe, 00000000.00000002.2110434279.000000000374E000.00000004.00000800.00020000.00000000.sdmp, Cleared Payment.exe, 00000004.00000002.3323797943.0000000000402000.00000040.00000400.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://smtp.italiacanda-it.com

unknown

https://api.ipify.org/t

unknown

Details

Name:	https://api.ipify.org/t
TargetID:	4
From Memory:	true
Current Path:	C:\Users\user\Desktop\Cleared Payment.exe
Source:	Cleared Payment.exe, 00000004.00000002.3325617856.0000000002D81000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://us2.smtp.mailhostbox.com

unknown

Details

Name:	http://us2.smtp.mailhostbox.com
TargetID:	4
From Memory:	true
Current Path:	C:\Users\user\Desktop\Cleared Payment.exe
Source:	Cleared Payment.exe, 00000004.00000002.3325617856.0000000002DFC000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

Details

Name:	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
TargetID:	4
From Memory:	true
Current Path:	C:\Users\user\Desktop\Cleared Payment.exe
Source:	Cleared Payment.exe, 00000004.00000002.3325617856.0000000002D81000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

smtp.italiacanda-it.com

unknown

us2.smtp.mailhostbox.com

208.91.199.223

Details

Name:	us2.smtp.mailhostbox.com
IP:	208.91.199.223
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol
URLs found in memory or binary data	Networking

api.ipify.org

104.26.13.205

Details

Name:	api.ipify.org
IP:	104.26.13.205
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

IPs

Domain

Country

Malicious

208.91.199.223

us2.smtp.mailhostbox.com

United States

Details

IP:	208.91.199.223
TargetID:	4
Current Path:	C:\Users\user\Desktop\Cleared Payment.exe
Country:	United States
Countrycode:	USA
ASN number:	394695
ASN name:	PUBLIC-DOMAIN-REGISTRYUS
Private:	false
Domain:	us2.smtp.mailhostbox.com

Signature Hits	Behavior Group	Mitre Attack
Snort IDS alert for network traffic	Networking
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol

104.26.13.205

api.ipify.org

United States

Details

IP:	104.26.13.205
TargetID:	4
Current Path:	C:\Users\user\Desktop\Cleared Payment.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	api.ipify.org

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cleared Payment_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cleared Payment_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cleared Payment_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cleared Payment_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cleared Payment_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cleared Payment_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cleared Payment_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cleared Payment_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cleared Payment_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cleared Payment_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cleared Payment_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cleared Payment_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cleared Payment_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Cleared Payment_RASMANCS

FileDirectory

There are 5 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

2DFC000

trusted library allocation

page read and write

2E04000

trusted library allocation

page read and write

3832000

trusted library allocation

page read and write

41D1000

trusted library allocation

page read and write

374E000

trusted library allocation

page read and write

402000

remote allocation

page execute and read and write

2DD1000

trusted library allocation

page read and write

13B7000

heap

page read and write

23B2000

trusted library allocation

page read and write

2C10000

trusted library allocation

page read and write

29E9000

trusted library allocation

page read and write

547E000

stack

page read and write

1330000

heap

page read and write

E5A000

stack

page read and write

681E000

stack

page read and write

2D2000

unkown

page readonly

29E5000

trusted library allocation

page read and write

4BE0000

heap

page read and write

29ED000

trusted library allocation

page read and write

6B3D000

trusted library allocation

page read and write

8F8000

heap

page read and write

29EF000

trusted library allocation

page read and write

5A3F000

stack

page read and write

6B47000

trusted library allocation

page read and write

6CA0000

trusted library allocation

page read and write

4F30000

heap

page read and write

8600000

trusted library allocation

page execute and read and write

58FE000

stack

page read and write

3579000

trusted library allocation

page read and write

1013000

heap

page read and write

6B90000

trusted library allocation

page read and write

29D1000

trusted library allocation

page read and write

29CF000

trusted library allocation

page read and write

F58000

stack

page read and write

4C00000

trusted library allocation

page read and write

8810000

heap

page read and write

2778000

trusted library allocation

page read and write

10F5000

heap

page read and write

4F20000

heap

page read and write

780000

heap

page read and write

505E000

stack

page read and write

4AF0000

trusted library allocation

page read and write

29F5000

trusted library allocation

page read and write

4F10000

trusted library allocation

page execute and read and write

29C1000

trusted library allocation

page read and write

870E000

stack

page read and write

37F5000

trusted library allocation

page read and write

1050000

heap

page read and write

8C0000

trusted library allocation

page read and write

53AE000

trusted library allocation

page read and write

4F40000

heap

page read and write

6C40000

trusted library allocation

page read and write

655D000

stack

page read and write

4AB6000

trusted library allocation

page read and write

8930000

trusted library section

page read and write

4A90000

trusted library allocation

page read and write

6C4F000

stack

page read and write

29F7000

trusted library allocation

page read and write

7F170000

trusted library allocation

page execute and read and write

6C97000

trusted library allocation

page read and write

4ABD000

trusted library allocation

page read and write

54BE000

stack

page read and write

89E000

stack

page read and write

6B1E000

stack

page read and write

13AB000

trusted library allocation

page execute and read and write

641D000

stack

page read and write

66EE000

heap

page read and write

FC0000

heap

page read and write

13A7000

trusted library allocation

page execute and read and write

2797000

trusted library allocation

page read and write

3D81000

trusted library allocation

page read and write

9DE000

heap

page read and write

35C7000

trusted library allocation

page read and write

6DE2000

trusted library allocation

page read and write

924000

heap

page read and write

6F7000

stack

page read and write

4AC2000

trusted library allocation

page read and write

6BF0000

trusted library section

page read and write

23AA000

trusted library allocation

page execute and read and write

275E000

trusted library allocation

page read and write

1009000

heap

page read and write

4C10000

trusted library allocation

page read and write

29E1000

trusted library allocation

page read and write

13B0000

heap

page read and write

139A000

trusted library allocation

page execute and read and write

4AC0000

trusted library allocation

page read and write

25D6000

trusted library allocation

page read and write

53D2000

trusted library allocation

page read and write

222000

unkown

page readonly

1396000

trusted library allocation

page execute and read and write

3615000

trusted library allocation

page read and write

2BF0000

heap

page execute and read and write

54F0000

heap

page read and write

2530000

trusted library allocation

page execute and read and write

8E3000

trusted library allocation

page read and write

4C0B000

trusted library allocation

page read and write

4BF0000

trusted library allocation

page read and write

4DFB000

stack

page read and write

4A94000

trusted library allocation

page read and write

3F0000

heap

page read and write

1016000

heap

page read and write

2C30000

heap

page read and write

8D3000

trusted library allocation

page execute and read and write

84F4000

heap

page read and write

1380000

trusted library allocation

page read and write

750000

heap

page read and write

1058000

heap

page read and write

400000

remote allocation

page execute and read and write

4BA0000

trusted library allocation

page read and write

2550000

trusted library allocation

page read and write

2560000

heap

page execute and read and write

6A5E000

stack

page read and write

241E000

stack

page read and write

8D4000

trusted library allocation

page read and write

29CD000

trusted library allocation

page read and write

4E88000

trusted library allocation

page read and write

29C7000

trusted library allocation

page read and write

6BEE000

stack

page read and write

10F0000

heap

page read and write

FE0000

heap

page read and write

7FB60000

trusted library allocation

page execute and read and write

785000

heap

page read and write

4AE0000

trusted library allocation

page read and write

6B9F000

stack

page read and write

137D000

trusted library allocation

page execute and read and write

37A000

stack

page read and write

4F00000

trusted library allocation

page read and write

FFD000

heap

page read and write

68FC000

heap

page read and write

29E7000

trusted library allocation

page read and write

4AAE000

trusted library allocation

page read and write

2DB6000

trusted library allocation

page read and write

917000

heap

page read and write

4F60000

heap

page read and write

220000

unkown

page readonly

29BD000

trusted library allocation

page read and write

2C04000

trusted library allocation

page read and write

4B60000

trusted library allocation

page execute and read and write

54D0000

heap

page execute and read and write

5125000

heap

page read and write

6F00000

heap

page read and write

AF0000

heap

page read and write

10A4000

heap

page read and write

29C3000

trusted library allocation

page read and write

6C30000

trusted library allocation

page execute and read and write

679E000

stack

page read and write

695E000

stack

page read and write

13A0000

trusted library allocation

page read and write

2571000

trusted library allocation

page read and write

29DD000

trusted library allocation

page read and write

2D3F000

stack

page read and write

66E0000

heap

page read and write

1374000

trusted library allocation

page read and write

4F5C000

stack

page read and write

2BBE000

stack

page read and write

29C5000

trusted library allocation

page read and write

2BE0000

trusted library allocation

page read and write

29F1000

trusted library allocation

page read and write

6BA0000

trusted library allocation

page execute and read and write

991000

heap

page read and write

464C000

stack

page read and write

2540000

trusted library allocation

page read and write

3663000

trusted library allocation

page read and write

6F10000

trusted library allocation

page execute and read and write

23B0000

trusted library allocation

page read and write

29D7000

trusted library allocation

page read and write

56FC000

stack

page read and write

1392000

trusted library allocation

page read and write

2669000

trusted library allocation

page read and write

6B40000

trusted library allocation

page read and write

71E0000

heap

page read and write

29DF000

trusted library allocation

page read and write

8E0000

trusted library allocation

page read and write

29BF000

trusted library allocation

page read and write

6C50000

trusted library allocation

page read and write

29EB000

trusted library allocation

page read and write

29C9000

trusted library allocation

page read and write

53C6000

trusted library allocation

page read and write

45B9000

trusted library allocation

page read and write

45B0000

trusted library allocation

page read and write

2B70000

trusted library allocation

page read and write

53B2000

trusted library allocation

page read and write

1390000

trusted library allocation

page read and write

23D0000

trusted library allocation

page read and write

971000

heap

page read and write

29DB000

trusted library allocation

page read and write

FD0000

heap

page read and write

23BB000

trusted library allocation

page execute and read and write

2E12000

trusted library allocation

page read and write

474B000

stack

page read and write

3DE6000

trusted library allocation

page read and write

A01E000

stack

page read and write

84A0000

heap

page read and write

4AD0000

trusted library allocation

page read and write

4DB0000

heap

page execute and read and write

6B8D000

stack

page read and write

1360000

trusted library allocation

page read and write

6A9E000

stack

page read and write

6B30000

trusted library allocation

page read and write

4EFE000

stack

page read and write

68E0000

heap

page read and write

4B20000

trusted library allocation

page read and write

27AC000

trusted library allocation

page read and write

6B28000

trusted library allocation

page read and write

89C0000

trusted library allocation

page read and write

68DE000

stack

page read and write

2DF8000

trusted library allocation

page read and write

665E000

stack

page read and write

45AE000

stack

page read and write

2C00000

trusted library allocation

page read and write

691F000

stack

page read and write

777000

heap

page read and write

57FE000

stack

page read and write

53AB000

trusted library allocation

page read and write

541C000

stack

page read and write

23A6000

trusted library allocation

page execute and read and write

2E0B000

trusted library allocation

page read and write

85A0000

trusted library section

page read and write

8D0000

trusted library allocation

page read and write

6ED0000

trusted library allocation

page read and write

2BD0000

trusted library allocation

page read and write

5500000

heap

page read and write

770000

heap

page read and write

8ED000

trusted library allocation

page execute and read and write

651E000

stack

page read and write

3571000

trusted library allocation

page read and write

29F3000

trusted library allocation

page read and write

593E000

stack

page read and write

6C10000

trusted library section

page read and write

6922000

heap

page read and write

2DFA000

trusted library allocation

page read and write

2627000

trusted library allocation

page read and write

936000

heap

page read and write

4AE5000

trusted library allocation

page read and write

6C90000

trusted library allocation

page read and write

138D000

trusted library allocation

page execute and read and write

73E000

stack

page read and write

9CDE000

stack

page read and write

23A2000

trusted library allocation

page read and write

53A0000

trusted library allocation

page read and write

53C1000

trusted library allocation

page read and write

2667000

trusted library allocation

page read and write

1220000

heap

page read and write

53BE000

trusted library allocation

page read and write

3E0000

heap

page read and write

933000

heap

page read and write

6C20000

trusted library section

page read and write

85F1000

trusted library allocation

page read and write

4B50000

heap

page read and write

2DF6000

trusted library allocation

page read and write

AEE000

stack

page read and write

6A1E000

stack

page read and write

53CD000

trusted library allocation

page read and write

669D000

stack

page read and write

54F3000

heap

page read and write

4BD0000

heap

page read and write

53A6000

trusted library allocation

page read and write

23A0000

trusted library allocation

page read and write

29E3000

trusted library allocation

page read and write

54E0000

heap

page read and write

53BA000

trusted library allocation

page read and write

2DCD000

trusted library allocation

page read and write

23B7000

trusted library allocation

page execute and read and write

29D3000

trusted library allocation

page read and write

13A2000

trusted library allocation

page read and write

1370000

trusted library allocation

page read and write

3DA9000

trusted library allocation

page read and write

6B20000

trusted library allocation

page read and write

29D5000

trusted library allocation

page read and write

4B80000

trusted library allocation

page execute and read and write

239E000

stack

page read and write

67DE000

stack

page read and write

6C9E000

stack

page read and write

2D81000

trusted library allocation

page read and write

FE8000

heap

page read and write

880D000

stack

page read and write

2420000

heap

page read and write

6BB0000

trusted library allocation

page execute and read and write

4BC0000

trusted library section

page readonly

1373000

trusted library allocation

page execute and read and write

45FD000

stack

page read and write

9A5000

heap

page read and write

4B73000

heap

page read and write

29D9000

trusted library allocation

page read and write

2DBF000

trusted library allocation

page read and write

5120000

heap

page read and write

8FE000

heap

page read and write

6CDE000

stack

page read and write

99ED000

trusted library allocation

page read and write

252F000

stack

page read and write

89B0000

trusted library allocation

page execute and read and write

9CF000

heap

page read and write

2A70000

trusted library allocation

page read and write

4B70000

heap

page read and write

13A5000

trusted library allocation

page execute and read and write

9F1E000

stack

page read and write

8F0000

heap

page read and write

8DD000

trusted library allocation

page execute and read and write

2BC0000

trusted library allocation

page execute and read and write

29CB000

trusted library allocation

page read and write

4AB1000

trusted library allocation

page read and write

There are 291 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Cleared Payment.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportCleared Payment.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
Cleared Payment.exe