IOC Report
slowday.exe

slowday.exe

PE32 executable (GUI) Intel 80386, for MS Windows

initial sample

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogons.url

MS Windows 95 Internet shortcut text (URL=<file:///C:\Users\user\AppData\Roaming\winlogons\winlogons.exe>), ASCII text, with CR line terminators

dropped

C:\Users\user\AppData\Roaming\winlogons\winlogons.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\Desktop\slowday.exe

"C:\Users\user\Desktop\slowday.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpF1A4.tmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmp33E2.tmp

C:\Users\user\AppData\Roaming\winlogons\winlogons.exe

"C:\Users\user\AppData\Roaming\winlogons\winlogons.exe"

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmp8255.tmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmp36CB.tmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmp7E2A.tmp

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpC5B7.tmp

https://a.pomf.cat/

unknown

http://pomf.cat/upload.php&https://a.pomf.cat/

unknown

http://pomf.cat/upload.php

unknown