IOC Report
Statement Of Account.exe

Statement Of Account.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

C:\Users\user\AppData\Local\Temp\tmp9A8F.tmp

XML 1.0 document, ASCII text

dropped

C:\Users\user\AppData\Roaming\SdYCcXyq.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Users\user\Desktop\Statement Of Account.exe

"C:\Users\user\Desktop\Statement Of Account.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Statement Of Account.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\SdYCcXyq.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SdYCcXyq" /XML "C:\Users\user\AppData\Local\Temp\tmp9A8F.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\explorer.exe

C:\Windows\Explorer.EXE

C:\Users\user\AppData\Roaming\SdYCcXyq.exe

C:\Users\user\AppData\Roaming\SdYCcXyq.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SdYCcXyq" /XML "C:\Users\user\AppData\Local\Temp\tmpAA00.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\SysWOW64\cmstp.exe

"C:\Windows\SysWOW64\cmstp.exe"

http://www.airzf.com/gs12/?r6-=DR9+51rACou4eQBXOdoZ4W0ewB14phJf97sbOZAiDLbqJph64OQ6FfPwpwURv63eY6pg&YN=9rKtZn5

154.12.38.29

http://www.b-a-s-e.net/gs12/?r6-=QIIWKxrtyX7LT6NTTkxUIHQxUymhf5FB+GXjykqQ4dPV8mdQoaOANT6/8pJ3wvHey5SR&YN=9rKtZn5

91.195.240.94