Automated Malware Analysis IOC Report for

Files

File Path

Type

Category

Malicious

Payment.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

Details

Filetype:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy:	7.137945706058082
Filename:	Payment.exe
Filesize:	1186304
MD5:	88e1a2d19bd93d64e6a3675c404bf424
SHA1:	4199075cc9c375b7a1dd85ab701e5fab010136eb
SHA256:	16b790ad37c38e92e2f7b102d2d622dd6a1e51f9614c72f404272536e4785be1
SHA512:	624e41236aac0a35eaf694f4ffa81a59a4992c86235c5494027f821172312b2566c20734b486421d948ddfd034e483778aadc91ffb93615382e48bc761f57f0b
SSDEEP:	24576:+AHnh+eWsN3skA4RV1Hom2KXMmHaKBb6Nk8QWbVLjgT7gx5:ph+ZkldoPK8YaKJykiJLj+q
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Binary is likely a compiled AutoIt script file	System Summary
Machine Learning detection for sample	AV Detection
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion
Contains functionality for read data from the clipboard	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to block mouse and keyboard input (often used to hinder debugging)	Anti Debugging
Contains functionality to check if a debugger is running (IsDebuggerPresent)	Anti Debugging
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)	Anti Debugging
Contains functionality to check if a window is minimized (may be used to check if an application is visible)	Hooking and other Techniques for Hiding and Protection
Contains functionality to communicate with device drivers	System Summary
Contains functionality to dynamically determine API calls	Data Obfuscation, Anti Debugging	Native API
Contains functionality to execute programs as a different user	HIPS / PFW / Operating System Protection Evasion
Contains functionality to launch a process as a different user	System Summary	Valid Accounts Native API Access Token Manipulation
Contains functionality to launch a program with higher privileges	HIPS / PFW / Operating System Protection Evasion	Exploitation for Privilege Escalation
Contains functionality to modify clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)	Remote Access Functionality
Contains functionality to query CPU information (cpuid)	Language, Device and Operating System Detection
Contains functionality to read the PEB	Anti Debugging
Contains functionality to read the clipboard data	Key, Mouse, Clipboard, Microphone and Screen Capturing	Clipboard Data
Contains functionality to retrieve information about pressed keystrokes	Key, Mouse, Clipboard, Microphone and Screen Capturing
Contains functionality to shutdown / reboot the system	System Summary	System Shutdown/Reboot
Contains functionality to simulate keystroke presses	HIPS / PFW / Operating System Protection Evasion
Contains functionality to simulate mouse events	HIPS / PFW / Operating System Protection Evasion
Contains functionality which may be used to detect a debugger (GetProcessHeap)	Anti Debugging	Security Software Discovery
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion
Detected potential crypto function	System Summary	Archive Collected Data
Extensive use of GetProcAddress (often used to hide API calls)	Hooking and other Techniques for Hiding and Protection
Found evasive API chain (date check)	Malware Analysis System Evasion
Found large amount of non-executed APIs	Malware Analysis System Evasion
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information	System Shutdown/Reboot
Potential key logger detected (key state polling based)	Key, Mouse, Clipboard, Microphone and Screen Capturing	Input Capture
Sample file is different than original file name gathered from version info	System Summary	System Shutdown/Reboot
Uses 32bit PE files	Compliance, System Summary
Uses code obfuscation techniques (call, push, ret)	Data Obfuscation
Contains functionality for error logging	System Summary
Contains functionality to add an ACL to a security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to adjust token privileges (e.g. debug / backup)	System Summary
Contains functionality to check free disk space	System Summary
Contains functionality to create a new security descriptor	HIPS / PFW / Operating System Protection Evasion
Contains functionality to download additional files from the internet	Networking	Ingress Tool Transfer
Contains functionality to enum processes or threads	System Summary
Contains functionality to enumerate / list files inside a directory	Spreading, Malware Analysis System Evasion	File and Directory Discovery
Contains functionality to instantiate COM classes	System Summary
Contains functionality to load and extract PE file embedded resources	System Summary
Contains functionality to query local / system time	Language, Device and Operating System Detection	System Time Discovery
Contains functionality to query system information	Malware Analysis System Evasion
Contains functionality to query the account / user name	Language, Device and Operating System Detection	Account Discovery System Owner/User Discovery
Contains functionality to query time zone information	Language, Device and Operating System Detection
Contains functionality to query windows version	Language, Device and Operating System Detection
Contains functionality to register its own exception handler	Anti Debugging
Creates temporary files	System Summary
Disables application error messsages (SetErrorMode)	Hooking and other Techniques for Hiding and Protection
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Program exit points	Malware Analysis System Evasion
Reads software policies	System Summary
Sample is known by Antivirus	System Summary
Tries to load missing DLLs	System Summary	DLL Side-Loading
PE file contains a valid data directory to section mapping	System Summary	Security Software Discovery
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Users\user\AppData\Local\Temp\Countee

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\Countee
Category:	dropped
Dump:	Countee.1.dr
ID:	dr_1
Target ID:	1
Process:	C:\Users\user\Desktop\Payment.exe
Type:	data
Entropy:	7.863362241110921
Encrypted:	false
Ssdeep:	6144:Uxr1TCETnEUOUJ+XxP/6H06/Jrcnb/6A/mybDU4jq1bEQQazy:OrBBEUx2qHnrcnbCA/mwVjRBp
Size:	268288
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\aut1FF7.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\aut1FF7.tmp
Category:	dropped
Dump:	aut1FF7.tmp.1.dr
ID:	dr_0
Target ID:	1
Process:	C:\Users\user\Desktop\Payment.exe
Type:	data
Entropy:	7.977819531829788
Encrypted:	false
Ssdeep:	6144:UnHO0hNvbHckX7KQVCwhuVC6CV3FERX8cPRDRc9osAAZOib6h:UBh9TckGahIG3eXRXc9osAdic
Size:	265598
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\aut2065.tmp

data

dropped

Details

File:	C:\Users\user\AppData\Local\Temp\aut2065.tmp
Category:	dropped
Dump:	aut2065.tmp.1.dr
ID:	dr_2
Target ID:	1
Process:	C:\Users\user\Desktop\Payment.exe
Type:	data
Entropy:	7.591423720363009
Encrypted:	false
Ssdeep:	192:mS5jnkklrTefgLqJrwy/6Yyu2f82lIBK60aa5wzyeP6e05P4VkljLr7LJdPei:VnI00wRW1oveP6e05wijX7td2i
Size:	9868
Whitelisted:	false
Reputation:	low

C:\Users\user\AppData\Local\Temp\subpredication

ASCII text, with very long lines (28714), with no line terminators

modified

Details

File:	C:\Users\user\AppData\Local\Temp\subpredication
Category:	modified
Dump:	subpredication.1.dr
ID:	dr_3
Target ID:	1
Process:	C:\Users\user\Desktop\Payment.exe
Type:	ASCII text, with very long lines (28714), with no line terminators
Entropy:	3.59341043207206
Encrypted:	false
Ssdeep:	768:DiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbiE+Ik6Ng4vfF3if6gyn:DiTZ+2QoioGRk6ZklputwjpjBkCiw2Rl
Size:	28714
Whitelisted:	false
Reputation:	low

Processes

Path

Cmdline

Malicious

C:\Users\user\Desktop\Payment.exe

"C:\Users\user\Desktop\Payment.exe"

Details

Is windows:	false
Is dropped:	false
PID:	1528
Target ID:	1
Parent PID:	4056
Name:	Payment.exe
Path:	C:\Users\user\Desktop\Payment.exe
Commandline:	"C:\Users\user\Desktop\Payment.exe"
Size:	1186304
MD5:	88E1A2D19BD93D64E6A3675C404BF424
Time:	22:36:02
Date:	18/04/2024
Reason:	newprocess
Reputation:	low
Is admin:	true
Is elevated:	true
Modulebase:	0x7a0000
Modulesize:	1212416
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Multi AV Scanner detection for submitted file	AV Detection
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Binary is likely a compiled AutoIt script file	System Summary
Initial sample is a PE file and has a suspicious name	System Summary
Machine Learning detection for sample	AV Detection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
OS version to string mapping found (often used in BOTs)	Stealing of Sensitive Information
Sample file is different than original file name gathered from version info	System Summary
Uses 32bit PE files	Compliance, System Summary
May try to detect the Windows Explorer process (often used for injection)	HIPS / PFW / Operating System Protection Evasion	Process Injection Process Discovery
PE file has an executable .text section and no other executable section	System Summary
Sample is known by Antivirus	System Summary
Spawns processes	System Summary	Process Injection
PE file contains a valid data directory to section mapping	System Summary
Binary contains paths to debug symbols	Compliance, System Summary
PE file contains a debug data directory	System Summary
PE file contains a mix of data directories often seen in goodware	System Summary
Submission file is bigger than most known malware samples	System Summary

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Users\user\Desktop\Payment.exe"

Details

Is windows:	true
Is dropped:	false
PID:	5836
Target ID:	10
Parent PID:	1528
Name:	RegSvcs.exe
Class:	system-tools
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Commandline:	"C:\Users\user\Desktop\Payment.exe"
Size:	45984
MD5:	9D352BC46709F0CB5EC974633A0C3C94
Time:	22:36:04
Date:	18/04/2024
Reason:	newprocess
Reputation:	high
Is admin:	true
Is elevated:	true
Modulebase:	0xa70000
Modulesize:	57344
Wow64:	true

Signature Hits	Behavior Group	Mitre Attack
Yara detected AgentTesla	Stealing of Sensitive Information, Remote Access Functionality
Yara detected PureLog Stealer	Stealing of Sensitive Information, Remote Access Functionality
Yara detected RedLine Stealer	Stealing of Sensitive Information, Remote Access Functionality
Maps a DLL or memory area into another process	HIPS / PFW / Operating System Protection Evasion	Process Injection
Writes to foreign memory regions	HIPS / PFW / Operating System Protection Evasion	Process Injection
Creates a process in suspended mode (likely to inject code)	HIPS / PFW / Operating System Protection Evasion	Process Injection
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Yara detected Credential Stealer	Stealing of Sensitive Information
Spawns processes	System Summary	Process Injection
Binary contains paths to debug symbols	Compliance, System Summary

URLs

Name

Malicious

smtp.italiacanda-it.com

Details

Name:	smtp.italiacanda-it.com
TargetID:	0
From Memory:	false
Source:	config extractor

Signature Hits	Behavior Group	Mitre Attack
Found malware configuration	AV Detection
C2 URLs / IPs found in malware configuration	Networking	Application Layer Protocol
URLs found in memory or binary data	Networking

https://api.ipify.org/

104.26.13.205

Details

Name:	https://api.ipify.org/
IP:	104.26.13.205
TargetID:	10
From Memory:	false
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	network
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
IP address seen in connection with other malware	Networking
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

https://api.ipify.org

unknown

Details

Name:	https://api.ipify.org
TargetID:	10
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 0000000A.00000002.2529262570.0000000002F71000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.2529070929.0000000002EC0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.2528725717.0000000002C9F000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.2531322668.0000000005590000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.2530653351.0000000003F71000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

https://account.dyn.com/

unknown

Details

Name:	https://account.dyn.com/
TargetID:	10
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 0000000A.00000002.2529070929.0000000002EC0000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.2528725717.0000000002C9F000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.2531322668.0000000005590000.00000004.08000000.00040000.00000000.sdmp, RegSvcs.exe, 0000000A.00000002.2530653351.0000000003F71000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://smtp.italiacanda-it.com

unknown

https://api.ipify.org/t

unknown

Details

Name:	https://api.ipify.org/t
TargetID:	10
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 0000000A.00000002.2529262570.0000000002F71000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://us2.smtp.mailhostbox.com

unknown

Details

Name:	http://us2.smtp.mailhostbox.com
TargetID:	10
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 0000000A.00000002.2529262570.0000000002FEF000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

unknown

Details

Name:	http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
TargetID:	10
From Memory:	true
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Source:	RegSvcs.exe, 0000000A.00000002.2529262570.0000000002F71000.00000004.00000800.00020000.00000000.sdmp
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
URLs found in memory or binary data	Networking

Domains

Name

Malicious

smtp.italiacanda-it.com

unknown

us2.smtp.mailhostbox.com

208.91.198.143

Details

Name:	us2.smtp.mailhostbox.com
IP:	208.91.198.143
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol
URLs found in memory or binary data	Networking

api.ipify.org

104.26.13.205

Details

Name:	api.ipify.org
IP:	104.26.13.205
TargetID:	-1
Active:	true
Reputation:	high

Signature Hits	Behavior Group	Mitre Attack
May check the online IP address of the machine	Networking	System Network Configuration Discovery
Uses a known web browser user agent for HTTP communication	Networking	Application Layer Protocol
Downloads files from webservers via HTTP	Networking	Application Layer Protocol Non-Application Layer Protocol Ingress Tool Transfer
Performs DNS lookups	Networking	Application Layer Protocol Non-Application Layer Protocol
URLs found in memory or binary data	Networking
Uses secure TLS version for HTTPS connections	Compliance, Networking

IPs

Domain

Country

Malicious

208.91.198.143

us2.smtp.mailhostbox.com

United States

Details

IP:	208.91.198.143
TargetID:	10
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	United States
Countrycode:	USA
ASN number:	394695
ASN name:	PUBLIC-DOMAIN-REGISTRYUS
Private:	false
Domain:	us2.smtp.mailhostbox.com

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Sigma detected: Suspicious Outbound SMTP Connections	System Summary
Uses SMTP (mail sending)	Networking	Application Layer Protocol

208.91.199.225

unknown

United States

Details

IP:	208.91.199.225
TargetID:	10
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	United States
Countrycode:	USA
ASN number:	394695
ASN name:	PUBLIC-DOMAIN-REGISTRYUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Uses SMTP (mail sending)	Networking	Application Layer Protocol

208.91.199.223

unknown

United States

Details

IP:	208.91.199.223
TargetID:	10
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	United States
Countrycode:	USA
ASN number:	394695
ASN name:	PUBLIC-DOMAIN-REGISTRYUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Uses SMTP (mail sending)	Networking	Application Layer Protocol

104.26.13.205

api.ipify.org

United States

Details

IP:	104.26.13.205
TargetID:	10
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	United States
Countrycode:	USA
ASN number:	13335
ASN name:	CLOUDFLARENETUS
Private:	false
Domain:	api.ipify.org

Signature Hits	Behavior Group	Mitre Attack
Uses secure TLS version for HTTPS connections	Compliance, Networking

208.91.199.224

unknown

United States

Details

IP:	208.91.199.224
TargetID:	10
Current Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Country:	United States
Countrycode:	USA
ASN number:	394695
ASN name:	PUBLIC-DOMAIN-REGISTRYUS
Private:	false

Signature Hits	Behavior Group	Mitre Attack
Detected TCP or UDP traffic on non-standard ports	Networking	Non-Standard Port
Uses SMTP (mail sending)	Networking	Application Layer Protocol

Registry

Path

Value

Malicious

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32

FileDirectory

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableAutoFileTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

EnableConsoleTracing

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

FileTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

ConsoleTracingMask

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

MaxFileSize

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS

FileDirectory

There are 5 hidden registries, click here to show them.

Memdumps

Base Address

Regiontype

Protect

Malicious

400000

system

page execute and read and write

1110000

direct allocation

page read and write

2EC0000

trusted library section

page read and write

2C9F000

heap

page read and write

5590000

trusted library section

page read and write

3F71000

trusted library allocation

page read and write

2FC4000

trusted library allocation

page read and write

2FEF000

trusted library allocation

page read and write

5630000

heap

page execute and read and write

11BD000

heap

page read and write

2B60000

trusted library allocation

page read and write

1160000

heap

page read and write

1188000

heap

page read and write

2B20000

trusted library allocation

page read and write

BE0000

heap

page read and write

4033000

trusted library allocation

page read and write

BC0000

heap

page read and write

426000

system

page execute and read and write

3CBD000

direct allocation

page read and write

EF8000

stack

page read and write

1060000

heap

page read and write

11EB000

heap

page read and write

1180000

heap

page read and write

1150000

heap

page read and write

1050000

trusted library allocation

page read and write

7A0000

unkown

page readonly

56C5000

heap

page read and write

1228000

heap

page read and write

5550000

trusted library allocation

page read and write

445000

system

page execute and read and write

561C000

stack

page read and write

12D2000

heap

page read and write

7A1000

unkown

page execute read

1176000

trusted library allocation

page execute and read and write

2B25000

trusted library allocation

page execute and read and write

11C0000

heap

page read and write

2FED000

trusted library allocation

page read and write

FBE000

stack

page read and write

12A3000

heap

page read and write

681E000

stack

page read and write

1044000

trusted library allocation

page read and write

126D000

heap

page read and write

1064000

heap

page read and write

3D2E000

direct allocation

page read and write

56B7000

heap

page read and write

1020000

trusted library section

page read and write

11BB000

heap

page read and write

6958000

trusted library allocation

page read and write

691E000

stack

page read and write

13CD000

heap

page read and write

2B27000

trusted library allocation

page execute and read and write

3B90000

direct allocation

page read and write

5BBF000

stack

page read and write

4072000

trusted library allocation

page read and write

3B13000

direct allocation

page read and write

3B90000

direct allocation

page read and write

B90000

trusted library allocation

page read and write

4F78000

trusted library allocation

page read and write

3B13000

direct allocation

page read and write

7A1000

unkown

page execute read

FDB000

stack

page read and write

1040000

trusted library allocation

page read and write

3CB9000

direct allocation

page read and write

12AC000

heap

page read and write

639F000

stack

page read and write

2F71000

trusted library allocation

page read and write

5CED000

stack

page read and write

5C8D000

trusted library allocation

page read and write

1352000

heap

page read and write

2F68000

heap

page read and write

5ABD000

stack

page read and write

117A000

trusted library allocation

page execute and read and write

3CB9000

direct allocation

page read and write

FF0000

heap

page read and write

1347000

heap

page read and write

2B2B000

trusted library allocation

page execute and read and write

11DB000

heap

page read and write

9E0000

heap

page read and write

1A1E000

stack

page read and write

104D000

trusted library allocation

page execute and read and write

1100000

direct allocation

page execute and read and write

6970000

trusted library allocation

page execute and read and write

2C70000

heap

page read and write

1050000

heap

page read and write

3CBD000

direct allocation

page read and write

868000

unkown

page readonly

B70000

heap

page read and write

3B90000

direct allocation

page read and write

30A8000

trusted library allocation

page read and write

7A0000

unkown

page readonly

5C80000

trusted library allocation

page read and write

39F0000

direct allocation

page read and write

2FAA000

trusted library allocation

page read and write

B87000

trusted library allocation

page read and write

3B90000

direct allocation

page read and write

11B0000

heap

page read and write

FFC000

stack

page read and write

13E5000

heap

page read and write

1257000

heap

page read and write

6EE0F000

unkown

page readonly

6EE06000

unkown

page readonly

855000

unkown

page readonly

13E4000

heap

page read and write

3CB9000

direct allocation

page read and write

13E5000

heap

page read and write

750000

heap

page read and write

3CBD000

direct allocation

page read and write

125E000

heap

page read and write

554E000

stack

page read and write

39F0000

direct allocation

page read and write

6960000

trusted library allocation

page read and write

85F000

unkown

page read and write

3B13000

direct allocation

page read and write

79E000

stack

page read and write

1060000

heap

page read and write

3B13000

direct allocation

page read and write

2E80000

trusted library allocation

page read and write

12BB000

heap

page read and write

2C4E000

stack

page read and write

12BD000

heap

page read and write

555B000

trusted library allocation

page read and write

12AB000

heap

page read and write

12D2000

heap

page read and write

85F000

unkown

page write copy

125E000

heap

page read and write

5576000

trusted library allocation

page read and write

5660000

heap

page read and write

3B13000

direct allocation

page read and write

3CB9000

direct allocation

page read and write

1414000

heap

page read and write

13A5000

heap

page read and write

1065000

heap

page read and write

2B83000

heap

page read and write

2B50000

trusted library allocation

page execute and read and write

5562000

trusted library allocation

page read and write

3B90000

direct allocation

page read and write

2FB3000

trusted library allocation

page read and write

3D2E000

direct allocation

page read and write

6EE0D000

unkown

page read and write

3B90000

direct allocation

page read and write

3001000

trusted library allocation

page read and write

5740000

heap

page read and write

12D3000

heap

page read and write

3CBD000

direct allocation

page read and write

12D2000

heap

page read and write

1404000

heap

page read and write

2FEB000

trusted library allocation

page read and write

6EDF0000

unkown

page readonly

1172000

trusted library allocation

page read and write

B0A000

stack

page read and write

13DF000

heap

page read and write

3CBD000

direct allocation

page read and write

12BC000

heap

page read and write

9DE000

stack

page read and write

3CB9000

direct allocation

page read and write

3D2E000

direct allocation

page read and write

3D2E000

direct allocation

page read and write

510E000

stack

page read and write

2C67000

heap

page read and write

6EDF1000

unkown

page execute read

1254000

heap

page read and write

3CB9000

direct allocation

page read and write

105D000

trusted library allocation

page execute and read and write

1170000

trusted library allocation

page read and write

12D2000

heap

page read and write

1244000

heap

page read and write

12D2000

heap

page read and write

1043000

trusted library allocation

page execute and read and write

39F0000

direct allocation

page read and write

2F30000

trusted library allocation

page read and write

2C50000

trusted library allocation

page read and write

5C90000

heap

page read and write

2BCE000

stack

page read and write

56AC000

heap

page read and write

2FC0000

trusted library allocation

page read and write

BB0000

trusted library allocation

page execute and read and write

BA0000

trusted library allocation

page read and write

12D2000

heap

page read and write

1030000

trusted library allocation

page read and write

2F20000

heap

page read and write

6980000

trusted library allocation

page read and write

597E000

stack

page read and write

2C60000

heap

page read and write

593C000

stack

page read and write

2B22000

trusted library allocation

page read and write

56A3000

heap

page read and write

1404000

heap

page read and write

FCE000

stack

page read and write

13F5000

heap

page read and write

1253000

heap

page read and write

6950000

trusted library allocation

page read and write

1405000

heap

page read and write

7F980000

trusted library allocation

page execute and read and write

B80000

trusted library allocation

page read and write

12D2000

heap

page read and write

67DF000

stack

page read and write

5648000

heap

page read and write

1010000

trusted library section

page read and write

3CBD000

direct allocation

page read and write

5646000

heap

page read and write

6964000

trusted library allocation

page read and write

12D2000

heap

page read and write

122C000

heap

page read and write

69CD000

stack

page read and write

2C0C000

stack

page read and write

12D2000

heap

page read and write

3B13000

direct allocation

page read and write

1220000

heap

page read and write

1053000

trusted library allocation

page read and write

2B40000

trusted library allocation

page read and write

557D000

trusted library allocation

page read and write

2E7E000

stack

page read and write

5571000

trusted library allocation

page read and write

5A7E000

stack

page read and write

5CA0000

trusted library allocation

page execute and read and write

3D2E000

direct allocation

page read and write

2F60000

heap

page read and write

556A000

trusted library allocation

page read and write

2E90000

trusted library allocation

page read and write

82F000

unkown

page readonly

6A5E000

stack

page read and write

868000

unkown

page readonly

39F0000

direct allocation

page read and write

1399000

heap

page read and write

39F0000

direct allocation

page read and write

556E000

trusted library allocation

page read and write

2EB0000

heap

page execute and read and write

5640000

heap

page read and write

1373000

heap

page read and write

5BFD000

stack

page read and write

2FF7000

trusted library allocation

page read and write

6AA0000

heap

page read and write

855000

unkown

page readonly

3D2E000

direct allocation

page read and write

863000

unkown

page write copy

82F000

unkown

page readonly

12F2000

heap

page read and write

1253000

heap

page read and write

125E000

heap

page read and write

39F0000

direct allocation

page read and write

555E000

trusted library allocation

page read and write

2B80000

heap

page read and write

6E9000

stack

page read and write

1E1E000

stack

page read and write

13C0000

heap

page read and write

There are 235 hidden memdumps, click here to show them.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC Report
Payment.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

IOC ReportPayment.exe

Files

Processes

URLs

Domains

IPs

Registry

Memdumps

IOC Report
Payment.exe