Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Payment.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\aut29F3.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut2A9F.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\outbluffed
|
ASCII text, with very long lines (28720), with no line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\pensum
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Payment.exe
|
"C:\Users\user\Desktop\Payment.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\Payment.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://api.ipify.org/
|
104.26.12.205
|
||
|
https://api.ipify.org
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
http://smtp.italiacanda-it.com
|
unknown
|
||
|
https://api.ipify.org/t
|
unknown
|
||
|
http://us2.smtp.mailhostbox.com
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
smtp.italiacanda-it.com
|
unknown
|
|
|
|
bg.microsoft.map.fastly.net
|
199.232.214.172
|
||
|
us2.smtp.mailhostbox.com
|
208.91.198.143
|
||
|
api.ipify.org
|
104.26.12.205
|
||
|
fp2e7a.wpc.phicdn.net
|
192.229.211.108
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
208.91.198.143
|
us2.smtp.mailhostbox.com
|
United States
|
||
|
104.26.12.205
|
api.ipify.org
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2150000
|
direct allocation
|
page read and write
|
|
|
|
402000
|
system
|
page execute and read and write
|
|
|
|
3341000
|
trusted library allocation
|
page read and write
|
|
|
|
3367000
|
trusted library allocation
|
page read and write
|
|
|
|
14A3000
|
heap
|
page read and write
|
||
|
3EC3000
|
direct allocation
|
page read and write
|
||
|
14DE000
|
heap
|
page read and write
|
||
|
123B000
|
stack
|
page read and write
|
||
|
14FC000
|
heap
|
page read and write
|
||
|
3F80000
|
direct allocation
|
page read and write
|
||
|
17E0000
|
trusted library allocation
|
page execute and read and write
|
||
|
3140000
|
trusted library allocation
|
page read and write
|
||
|
3DE0000
|
direct allocation
|
page read and write
|
||
|
6BF0000
|
trusted library allocation
|
page read and write
|
||
|
1605000
|
heap
|
page read and write
|
||
|
B8F000
|
unkown
|
page read and write
|
||
|
B5F000
|
unkown
|
page readonly
|
||
|
12F0000
|
heap
|
page read and write
|
||
|
411E000
|
direct allocation
|
page read and write
|
||
|
3326000
|
trusted library allocation
|
page read and write
|
||
|
1630000
|
heap
|
page read and write
|
||
|
125C000
|
stack
|
page read and write
|
||
|
6BEE000
|
stack
|
page read and write
|
||
|
14AF000
|
heap
|
page read and write
|
||
|
1790000
|
trusted library allocation
|
page read and write
|
||
|
70B0000
|
trusted library allocation
|
page execute and read and write
|
||
|
40DE000
|
direct allocation
|
page read and write
|
||
|
FA0000
|
heap
|
page read and write
|
||
|
6B6F000
|
stack
|
page read and write
|
||
|
14CE000
|
heap
|
page read and write
|
||
|
3150000
|
trusted library allocation
|
page read and write
|
||
|
68CE000
|
stack
|
page read and write
|
||
|
5910000
|
heap
|
page execute and read and write
|
||
|
411E000
|
direct allocation
|
page read and write
|
||
|
17BB000
|
trusted library allocation
|
page execute and read and write
|
||
|
312D000
|
trusted library allocation
|
page read and write
|
||
|
6B80000
|
trusted library allocation
|
page read and write
|
||
|
58ED000
|
stack
|
page read and write
|
||
|
14EF000
|
heap
|
page read and write
|
||
|
B85000
|
unkown
|
page readonly
|
||
|
12B0000
|
heap
|
page read and write
|
||
|
1625000
|
heap
|
page read and write
|
||
|
333D000
|
trusted library allocation
|
page read and write
|
||
|
1595000
|
heap
|
page read and write
|
||
|
AD1000
|
unkown
|
page execute read
|
||
|
3106000
|
trusted library allocation
|
page read and write
|
||
|
638E000
|
stack
|
page read and write
|
||
|
12C0000
|
heap
|
page read and write
|
||
|
1649000
|
heap
|
page read and write
|
||
|
12F8000
|
stack
|
page read and write
|
||
|
15D8000
|
heap
|
page read and write
|
||
|
14FB000
|
heap
|
page read and write
|
||
|
14DE000
|
heap
|
page read and write
|
||
|
6A6E000
|
stack
|
page read and write
|
||
|
411E000
|
direct allocation
|
page read and write
|
||
|
3DA0000
|
direct allocation
|
page read and write
|
||
|
14F0000
|
heap
|
page read and write
|
||
|
6630000
|
heap
|
page read and write
|
||
|
70C0000
|
heap
|
page read and write
|
||
|
14AF000
|
heap
|
page read and write
|
||
|
14A3000
|
heap
|
page read and write
|
||
|
40DE000
|
direct allocation
|
page read and write
|
||
|
40AD000
|
direct allocation
|
page read and write
|
||
|
4069000
|
direct allocation
|
page read and write
|
||
|
1435000
|
heap
|
page read and write
|
||
|
AD0000
|
unkown
|
page readonly
|
||
|
17B0000
|
trusted library allocation
|
page read and write
|
||
|
3F80000
|
direct allocation
|
page read and write
|
||
|
6CAF000
|
stack
|
page read and write
|
||
|
6B9D000
|
trusted library allocation
|
page read and write
|
||
|
1430000
|
heap
|
page read and write
|
||
|
7070000
|
trusted library allocation
|
page read and write
|
||
|
42F1000
|
trusted library allocation
|
page read and write
|
||
|
15F6000
|
heap
|
page read and write
|
||
|
3DE0000
|
direct allocation
|
page read and write
|
||
|
311E000
|
trusted library allocation
|
page read and write
|
||
|
17B5000
|
trusted library allocation
|
page execute and read and write
|
||
|
40A9000
|
direct allocation
|
page read and write
|
||
|
6C10000
|
trusted library allocation
|
page execute and read and write
|
||
|
40A9000
|
direct allocation
|
page read and write
|
||
|
3F40000
|
direct allocation
|
page read and write
|
||
|
30E0000
|
heap
|
page read and write
|
||
|
1784000
|
trusted library allocation
|
page read and write
|
||
|
17A6000
|
trusted library allocation
|
page execute and read and write
|
||
|
6D00000
|
trusted library allocation
|
page read and write
|
||
|
435B000
|
trusted library allocation
|
page read and write
|
||
|
21C0000
|
heap
|
page read and write
|
||
|
40DE000
|
direct allocation
|
page read and write
|
||
|
6C00000
|
trusted library allocation
|
page execute and read and write
|
||
|
14AF000
|
heap
|
page read and write
|
||
|
1780000
|
trusted library allocation
|
page read and write
|
||
|
3F40000
|
direct allocation
|
page read and write
|
||
|
F3A000
|
stack
|
page read and write
|
||
|
5B1E000
|
stack
|
page read and write
|
||
|
3DA0000
|
direct allocation
|
page read and write
|
||
|
144E000
|
stack
|
page read and write
|
||
|
1560000
|
heap
|
page read and write
|
||
|
31AC000
|
stack
|
page read and write
|
||
|
3100000
|
trusted library allocation
|
page read and write
|
||
|
3126000
|
trusted library allocation
|
page read and write
|
||
|
17F0000
|
trusted library allocation
|
page read and write
|
||
|
17B7000
|
trusted library allocation
|
page execute and read and write
|
||
|
1568000
|
heap
|
page read and write
|
||
|
179D000
|
trusted library allocation
|
page execute and read and write
|
||
|
B93000
|
unkown
|
page write copy
|
||
|
14FB000
|
heap
|
page read and write
|
||
|
178D000
|
trusted library allocation
|
page execute and read and write
|
||
|
3F40000
|
direct allocation
|
page read and write
|
||
|
14FB000
|
heap
|
page read and write
|
||
|
4319000
|
trusted library allocation
|
page read and write
|
||
|
151B000
|
heap
|
page read and write
|
||
|
1807000
|
heap
|
page read and write
|
||
|
14FB000
|
heap
|
page read and write
|
||
|
5CDD000
|
stack
|
page read and write
|
||
|
6BA7000
|
trusted library allocation
|
page read and write
|
||
|
1800000
|
heap
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
3DA0000
|
direct allocation
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
6A0E000
|
stack
|
page read and write
|
||
|
53EE000
|
stack
|
page read and write
|
||
|
6CF7000
|
trusted library allocation
|
page read and write
|
||
|
1632000
|
heap
|
page read and write
|
||
|
2120000
|
heap
|
page read and write
|
||
|
14EE000
|
heap
|
page read and write
|
||
|
17AA000
|
trusted library allocation
|
page execute and read and write
|
||
|
3F80000
|
direct allocation
|
page read and write
|
||
|
310B000
|
trusted library allocation
|
page read and write
|
||
|
17D0000
|
trusted library allocation
|
page read and write
|
||
|
586E000
|
stack
|
page read and write
|
||
|
4069000
|
direct allocation
|
page read and write
|
||
|
3008000
|
trusted library allocation
|
page read and write
|
||
|
15F6000
|
heap
|
page read and write
|
||
|
6CF0000
|
trusted library allocation
|
page read and write
|
||
|
332F000
|
trusted library allocation
|
page read and write
|
||
|
6BA0000
|
trusted library allocation
|
page read and write
|
||
|
30F0000
|
trusted library allocation
|
page read and write
|
||
|
5A1C000
|
stack
|
page read and write
|
||
|
E5A000
|
stack
|
page read and write
|
||
|
4069000
|
direct allocation
|
page read and write
|
||
|
31B3000
|
heap
|
page read and write
|
||
|
206E000
|
stack
|
page read and write
|
||
|
3382000
|
trusted library allocation
|
page read and write
|
||
|
406D000
|
direct allocation
|
page read and write
|
||
|
160A000
|
heap
|
page read and write
|
||
|
14FB000
|
heap
|
page read and write
|
||
|
70A0000
|
heap
|
page read and write
|
||
|
15E7000
|
heap
|
page read and write
|
||
|
3F03000
|
direct allocation
|
page read and write
|
||
|
40AD000
|
direct allocation
|
page read and write
|
||
|
1598000
|
heap
|
page read and write
|
||
|
158B000
|
heap
|
page read and write
|
||
|
15CF000
|
heap
|
page read and write
|
||
|
1850000
|
heap
|
page read and write
|
||
|
B98000
|
unkown
|
page readonly
|
||
|
14FB000
|
heap
|
page read and write
|
||
|
343C000
|
trusted library allocation
|
page read and write
|
||
|
2110000
|
heap
|
page read and write
|
||
|
1470000
|
heap
|
page read and write
|
||
|
B5F000
|
unkown
|
page readonly
|
||
|
14FB000
|
heap
|
page read and write
|
||
|
184E000
|
stack
|
page read and write
|
||
|
B85000
|
unkown
|
page readonly
|
||
|
32F1000
|
trusted library allocation
|
page read and write
|
||
|
3DE0000
|
direct allocation
|
page read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
14EE000
|
heap
|
page read and write
|
||
|
310E000
|
trusted library allocation
|
page read and write
|
||
|
690E000
|
stack
|
page read and write
|
||
|
1570000
|
heap
|
page read and write
|
||
|
121F000
|
stack
|
page read and write
|
||
|
3F03000
|
direct allocation
|
page read and write
|
||
|
406D000
|
direct allocation
|
page read and write
|
||
|
2124000
|
heap
|
page read and write
|
||
|
140D000
|
stack
|
page read and write
|
||
|
337B000
|
trusted library allocation
|
page read and write
|
||
|
17A2000
|
trusted library allocation
|
page read and write
|
||
|
3132000
|
trusted library allocation
|
page read and write
|
||
|
1540000
|
heap
|
page read and write
|
||
|
17A0000
|
trusted library allocation
|
page read and write
|
||
|
15E6000
|
heap
|
page read and write
|
||
|
406D000
|
direct allocation
|
page read and write
|
||
|
5730000
|
heap
|
page read and write
|
||
|
5900000
|
heap
|
page read and write
|
||
|
14CE000
|
heap
|
page read and write
|
||
|
311A000
|
trusted library allocation
|
page read and write
|
||
|
32EF000
|
stack
|
page read and write
|
||
|
6B88000
|
trusted library allocation
|
page read and write
|
||
|
6590000
|
heap
|
page read and write
|
||
|
B8F000
|
unkown
|
page write copy
|
||
|
1477000
|
heap
|
page read and write
|
||
|
2140000
|
direct allocation
|
page execute and read and write
|
||
|
1605000
|
heap
|
page read and write
|
||
|
40AD000
|
direct allocation
|
page read and write
|
||
|
AD1000
|
unkown
|
page execute read
|
||
|
5C1F000
|
stack
|
page read and write
|
||
|
58AE000
|
stack
|
page read and write
|
||
|
31B0000
|
heap
|
page read and write
|
||
|
3121000
|
trusted library allocation
|
page read and write
|
||
|
1C6E000
|
stack
|
page read and write
|
||
|
661E000
|
heap
|
page read and write
|
||
|
1770000
|
trusted library allocation
|
page read and write
|
||
|
3F03000
|
direct allocation
|
page read and write
|
||
|
6B90000
|
trusted library allocation
|
page read and write
|
||
|
3EC3000
|
direct allocation
|
page read and write
|
||
|
122F000
|
stack
|
page read and write
|
||
|
40A9000
|
direct allocation
|
page read and write
|
||
|
3112000
|
trusted library allocation
|
page read and write
|
||
|
3EC3000
|
direct allocation
|
page read and write
|
||
|
1783000
|
trusted library allocation
|
page execute and read and write
|
||
|
30DC000
|
stack
|
page read and write
|
||
|
7F220000
|
trusted library allocation
|
page execute and read and write
|
||
|
17B2000
|
trusted library allocation
|
page read and write
|
||
|
31E0000
|
heap
|
page execute and read and write
|
||
|
AD0000
|
unkown
|
page readonly
|
||
|
B98000
|
unkown
|
page readonly
|
There are 206 hidden memdumps, click here to show them.