IOC Report
Payment details.exe

loading gif

Files

File Path
Type
Category
Malicious
Payment details.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment details.exe.log
ASCII text, with CRLF line terminators
modified

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Payment details.exe
"C:\Users\user\Desktop\Payment details.exe"
 malicious
C:\Users\user\Desktop\Payment details.exe
"C:\Users\user\Desktop\Payment details.exe"
 malicious

URLs

Name
IP
Malicious
https://api.ipify.org/
104.26.13.205
http://r3.o.lencr.org0
unknown
https://api.ipify.org
unknown
https://account.dyn.com/
unknown
https://api.ipify.org/t
unknown
http://mail.teddyjnr.com
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://x1.c.lencr.org/0
unknown
http://x1.i.lencr.org/0
unknown
http://r3.i.lencr.org/0
unknown

Domains

Name
IP
Malicious
mail.teddyjnr.com
50.87.145.190
 malicious
api.ipify.org
104.26.13.205

IPs

IP
Domain
Country
Malicious
50.87.145.190
mail.teddyjnr.com
United States
malicious
104.26.13.205
api.ipify.org
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Payment details_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Payment details_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Payment details_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Payment details_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Payment details_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Payment details_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Payment details_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Payment details_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Payment details_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Payment details_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Payment details_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Payment details_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Payment details_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\Payment details_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
30C4000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
3091000
trusted library allocation
page read and write
 malicious
30BC000
trusted library allocation
page read and write
 malicious
36B7000
trusted library allocation
page read and write
 malicious
4EAD000
stack
page read and write
40A7000
trusted library allocation
page read and write
7260000
trusted library allocation
page read and write
2FA000
stack
page read and write
3EA7000
trusted library allocation
page read and write
30B6000
trusted library allocation
page read and write
8DA000
heap
page read and write
846000
trusted library allocation
page execute and read and write
517E000
stack
page read and write
83D0000
heap
page read and write
984000
heap
page read and write
25AB000
trusted library allocation
page read and write
6BE000
stack
page read and write
25F0000
heap
page execute and read and write
8BE000
stack
page read and write
402E000
trusted library allocation
page read and write
6D9E000
stack
page read and write
3081000
trusted library allocation
page read and write
4F35000
heap
page read and write
4BCD000
trusted library allocation
page read and write
5C50000
trusted library allocation
page read and write
980000
heap
page read and write
577D000
stack
page read and write
4D80000
trusted library section
page read and write
13E6000
trusted library allocation
page execute and read and write
2600000
trusted library allocation
page read and write
4A90000
trusted library allocation
page read and write
3EF5000
trusted library allocation
page read and write
30B8000
trusted library allocation
page read and write
2640000
heap
page read and write
F99000
stack
page read and write
820000
trusted library allocation
page read and write
1B0000
unkown
page readonly
15D5000
trusted library allocation
page execute and read and write
5532000
trusted library allocation
page read and write
57B0000
heap
page execute and read and write
97C000
heap
page read and write
15D0000
trusted library allocation
page read and write
15F0000
trusted library allocation
page read and write
863E000
stack
page read and write
904000
heap
page read and write
2620000
trusted library allocation
page read and write
135E000
heap
page read and write
90F000
heap
page read and write
6BCE000
stack
page read and write
2B52000
trusted library allocation
page read and write
840000
trusted library allocation
page read and write
4F40000
trusted library allocation
page execute and read and write
7F510000
trusted library allocation
page execute and read and write
30D6000
trusted library allocation
page read and write
13EA000
trusted library allocation
page execute and read and write
13E0000
trusted library allocation
page read and write
842000
trusted library allocation
page read and write
1867000
heap
page read and write
870000
trusted library allocation
page read and write
24EE000
stack
page read and write
474C000
stack
page read and write
5780000
heap
page read and write
68DE000
stack
page read and write
4B23000
heap
page read and write
6DF0000
trusted library allocation
page execute and read and write
1644000
trusted library allocation
page read and write
4B7B000
stack
page read and write
6E8E000
stack
page read and write
1610000
trusted library allocation
page read and write
4AF0000
trusted library allocation
page execute and read and write
978000
heap
page read and write
2615000
trusted library allocation
page read and write
4FB0000
heap
page read and write
12F3000
heap
page read and write
6BA6000
heap
page read and write
85B000
trusted library allocation
page execute and read and write
4AD0000
heap
page read and write
857000
trusted library allocation
page execute and read and write
59BC000
stack
page read and write
6AE0000
trusted library allocation
page execute and read and write
5512000
trusted library allocation
page read and write
1860000
heap
page read and write
4041000
trusted library allocation
page read and write
67CE000
stack
page read and write
13F5000
heap
page read and write
3041000
trusted library allocation
page read and write
6C9E000
stack
page read and write
13CD000
trusted library allocation
page execute and read and write
6A1F000
stack
page read and write
67DD000
stack
page read and write
830000
trusted library allocation
page read and write
552D000
trusted library allocation
page read and write
4BCB000
trusted library allocation
page read and write
1280000
heap
page read and write
6B6C000
heap
page read and write
98DF000
stack
page read and write
6ED0000
trusted library allocation
page read and write
4BA0000
heap
page read and write
13E2000
trusted library allocation
page read and write
252E000
stack
page read and write
303E000
stack
page read and write
6DDD000
stack
page read and write
99DE000
stack
page read and write
25C6000
trusted library allocation
page read and write
6D92000
trusted library allocation
page read and write
72A0000
heap
page read and write
7270000
heap
page read and write
1660000
heap
page read and write
8DE000
heap
page read and write
6EE7000
trusted library allocation
page read and write
AF0000
heap
page read and write
2695000
trusted library allocation
page read and write
6C30000
trusted library allocation
page read and write
7480000
trusted library allocation
page execute and read and write
25D2000
trusted library allocation
page read and write
4F90000
heap
page read and write
6A5E000
stack
page read and write
660000
heap
page read and write
15D7000
trusted library allocation
page execute and read and write
705000
heap
page read and write
1250000
heap
page read and write
2776000
trusted library allocation
page read and write
68CE000
stack
page read and write
2F30000
heap
page execute and read and write
9C1E000
stack
page read and write
12F6000
heap
page read and write
2610000
trusted library allocation
page read and write
57C0000
heap
page read and write
A718000
trusted library allocation
page read and write
4F50000
trusted library allocation
page read and write
25A0000
trusted library allocation
page read and write
1640000
trusted library allocation
page read and write
551A000
trusted library allocation
page read and write
7250000
trusted library allocation
page read and write
5BBF000
stack
page read and write
6C7D000
stack
page read and write
13C0000
trusted library allocation
page read and write
6B60000
heap
page read and write
50D0000
trusted library section
page read and write
4B20000
heap
page read and write
4AE0000
trusted library allocation
page read and write
30CE000
trusted library allocation
page read and write
1630000
trusted library allocation
page read and write
5526000
trusted library allocation
page read and write
550E000
trusted library allocation
page read and write
4BC0000
trusted library allocation
page read and write
6FE000
stack
page read and write
5C60000
heap
page read and write
4F30000
heap
page read and write
670000
heap
page read and write
3F6000
stack
page read and write
6B5E000
stack
page read and write
824000
trusted library allocation
page read and write
12C0000
heap
page read and write
2651000
trusted library allocation
page read and write
4B00000
trusted library allocation
page read and write
691D000
stack
page read and write
6AD0000
trusted library allocation
page read and write
1B2000
unkown
page readonly
4F80000
heap
page read and write
3679000
trusted library allocation
page read and write
2530000
trusted library allocation
page read and write
823000
trusted library allocation
page execute and read and write
3F43000
trusted library allocation
page read and write
7FD00000
trusted library allocation
page execute and read and write
2692000
trusted library allocation
page read and write
50C0000
trusted library section
page read and write
13DD000
trusted library allocation
page execute and read and write
1650000
trusted library allocation
page read and write
5C40000
trusted library allocation
page read and write
2532000
trusted library allocation
page read and write
9AE0000
heap
page read and write
12EA000
heap
page read and write
183E000
stack
page read and write
50BE000
stack
page read and write
669E000
stack
page read and write
9ADD000
stack
page read and write
5521000
trusted library allocation
page read and write
15DB000
trusted library allocation
page execute and read and write
4B80000
trusted library section
page readonly
13C3000
trusted library allocation
page execute and read and write
400000
remote allocation
page execute and read and write
911000
heap
page read and write
3659000
trusted library allocation
page read and write
ACF000
stack
page read and write
5C57000
trusted library allocation
page read and write
30BA000
trusted library allocation
page read and write
2E88000
trusted library allocation
page read and write
84A000
trusted library allocation
page execute and read and write
6BE0000
heap
page read and write
8C0000
trusted library allocation
page execute and read and write
307F000
trusted library allocation
page read and write
97DE000
stack
page read and write
679F000
stack
page read and write
13C4000
trusted library allocation
page read and write
BFE000
stack
page read and write
6C38000
trusted library allocation
page read and write
308D000
trusted library allocation
page read and write
13F0000
heap
page read and write
9B6000
heap
page read and write
669E000
heap
page read and write
810000
trusted library allocation
page read and write
5ABE000
stack
page read and write
4D60000
trusted library allocation
page read and write
8640000
trusted library section
page read and write
D07000
heap
page read and write
4BB0000
trusted library allocation
page execute and read and write
134F000
heap
page read and write
28AE000
trusted library allocation
page read and write
5C4D000
trusted library allocation
page read and write
507C000
stack
page read and write
1600000
trusted library allocation
page execute and read and write
9D5E000
stack
page read and write
4069000
trusted library allocation
page read and write
6BE0000
trusted library allocation
page execute and read and write
4F70000
heap
page read and write
AC80000
trusted library section
page read and write
56FE000
stack
page read and write
12B0000
trusted library allocation
page read and write
55B0000
heap
page read and write
6690000
heap
page read and write
550B000
trusted library allocation
page read and write
25C1000
trusted library allocation
page read and write
83D000
trusted library allocation
page execute and read and write
25E0000
trusted library allocation
page read and write
13D0000
trusted library allocation
page read and write
D00000
heap
page read and write
4B90000
heap
page read and write
700000
heap
page read and write
557C000
stack
page read and write
852000
trusted library allocation
page read and write
134A000
heap
page read and write
3077000
trusted library allocation
page read and write
5506000
trusted library allocation
page read and write
12C8000
heap
page read and write
6C20000
trusted library allocation
page read and write
258B000
stack
page read and write
55B3000
heap
page read and write
AD0000
heap
page read and write
6DE0000
trusted library allocation
page execute and read and write
631F000
stack
page read and write
5500000
trusted library allocation
page read and write
4DA0000
heap
page execute and read and write
15D2000
trusted library allocation
page read and write
57A8000
trusted library allocation
page read and write
1620000
heap
page read and write
2590000
trusted library allocation
page read and write
573E000
stack
page read and write
8D0000
heap
page read and write
6EE0000
trusted library allocation
page read and write
1200000
heap
page read and write
57A0000
trusted library allocation
page read and write
3651000
trusted library allocation
page read and write
E99000
stack
page read and write
9E5E000
stack
page read and write
9D1E000
stack
page read and write
CFE000
stack
page read and write
82D000
trusted library allocation
page execute and read and write
841D000
heap
page read and write
25BE000
trusted library allocation
page read and write
551E000
trusted library allocation
page read and write
25CD000
trusted library allocation
page read and write
There are 253 hidden memdumps, click here to show them.