IOC Report
fatura.bat.exe

loading gif

Files

File Path
Type
Category
Malicious
fatura.bat.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\note\nots.dat
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmpAAA4.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\KGuxmqSTXgJca.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KGuxmqSTXgJca.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fatura.bat.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\json[1].json
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2uamyaq1.zpv.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bol0pcrw.z3l.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gckufed5.0c3.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yvsphlti.aln.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmpC233.tmp
XML 1.0 document, ASCII text
dropped
C:\Users\user\AppData\Roaming\KGuxmqSTXgJca.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
There are 4 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\fatura.bat.exe
"C:\Users\user\Desktop\fatura.bat.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\KGuxmqSTXgJca.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KGuxmqSTXgJca" /XML "C:\Users\user\AppData\Local\Temp\tmpAAA4.tmp"
 malicious
C:\Users\user\Desktop\fatura.bat.exe
"C:\Users\user\Desktop\fatura.bat.exe"
 malicious
C:\Users\user\Desktop\fatura.bat.exe
"C:\Users\user\Desktop\fatura.bat.exe"
 malicious
C:\Users\user\AppData\Roaming\KGuxmqSTXgJca.exe
C:\Users\user\AppData\Roaming\KGuxmqSTXgJca.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KGuxmqSTXgJca" /XML "C:\Users\user\AppData\Local\Temp\tmpC233.tmp"
 malicious
C:\Users\user\AppData\Roaming\KGuxmqSTXgJca.exe
"C:\Users\user\AppData\Roaming\KGuxmqSTXgJca.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 2 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://geoplugin.net/json.gp
178.237.33.50
 malicious
sembe.duckdns.org
malicious
http://geoplugin.net/json.gp/C
unknown
 malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
http://www.fontbureau.com/designers?
unknown
http://www.tiro.com
unknown
http://www.fontbureau.com/designers
unknown
http://www.goodfont.co.kr
unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0
unknown
http://geoplugin.net/json.gpSystem32
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://www.jiyu-kobo.co.jp/
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.sandoll.co.kr
unknown
http://www.urwpp.deDPlease
unknown
http://ocsp.comodoca.co
unknown
http://www.zhongyicts.com.cn
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.sakkal.com
unknown
https://secure.comodo
unknown
There are 23 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
sembe.duckdns.org
194.187.251.115
 malicious
geoplugin.net
178.237.33.50

IPs

IP
Domain
Country
Malicious
194.187.251.115
sembe.duckdns.org
United Kingdom
malicious
178.237.33.50
geoplugin.net
Netherlands

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-999Z97
exepath
 malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-999Z97
licence
 malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-999Z97
time
 malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
2B21000
trusted library allocation
page read and write
 malicious
3261000
trusted library allocation
page read and write
 malicious
5C10000
trusted library section
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
A9B000
heap
page read and write
 malicious
443E000
trusted library allocation
page read and write
 malicious
ED7000
heap
page read and write
 malicious
9FAE000
stack
page read and write
1401000
heap
page read and write
F55000
heap
page read and write
172B000
stack
page read and write
2610000
heap
page read and write
9ACE000
stack
page read and write
13B0000
trusted library allocation
page execute and read and write
1380000
trusted library allocation
page read and write
17B0000
trusted library allocation
page read and write
478000
remote allocation
page execute and read and write
2AA0000
trusted library allocation
page read and write
4353000
trusted library allocation
page read and write
103E000
stack
page read and write
B2E000
stack
page read and write
2D3F000
stack
page read and write
3CFE000
trusted library allocation
page read and write
D2A000
heap
page read and write
7760000
heap
page read and write
1350000
trusted library allocation
page read and write
75F000
stack
page read and write
4F20000
heap
page read and write
7A5F000
trusted library allocation
page read and write
145B000
heap
page read and write
CB7000
heap
page read and write
BB0000
trusted library allocation
page read and write
A0EE000
stack
page read and write
178E000
trusted library allocation
page read and write
530D000
stack
page read and write
17C0000
heap
page read and write
12F7000
stack
page read and write
2C3D000
stack
page read and write
CD2000
heap
page read and write
3FCB000
trusted library allocation
page read and write
5125000
heap
page read and write
AF7E000
stack
page read and write
3C13000
trusted library allocation
page read and write
16E0000
heap
page read and write
4F00000
heap
page read and write
5930000
trusted library section
page readonly
4E82000
trusted library allocation
page read and write
F4D000
heap
page read and write
56F3000
heap
page read and write
2A81000
trusted library allocation
page read and write
AE3F000
stack
page read and write
6D61000
heap
page read and write
5330000
heap
page read and write
A82E000
stack
page read and write
2BFF000
stack
page read and write
C60000
heap
page read and write
5350000
heap
page read and write
A60000
heap
page read and write
BFB000
trusted library allocation
page execute and read and write
B0BE000
stack
page read and write
6F30000
trusted library allocation
page read and write
620000
heap
page read and write
D36000
heap
page read and write
F50000
heap
page read and write
AAAE000
stack
page read and write
56D0000
heap
page read and write
35EA000
trusted library allocation
page read and write
5CF000
unkown
page read and write
629E000
heap
page read and write
7D00000
trusted library allocation
page execute and read and write
CC5000
heap
page read and write
E9E000
stack
page read and write
2AC0000
trusted library allocation
page read and write
6D7B000
heap
page read and write
2AE0000
trusted library allocation
page read and write
3B29000
trusted library allocation
page read and write
4305000
trusted library allocation
page read and write
2E3F000
stack
page read and write
747F000
stack
page read and write
9D6E000
stack
page read and write
3190000
heap
page read and write
93C000
stack
page read and write
78B3000
heap
page read and write
13CE000
heap
page read and write
31D0000
heap
page read and write
2A20000
heap
page read and write
40AF000
trusted library allocation
page read and write
A22C000
stack
page read and write
CFC000
stack
page read and write
5950000
heap
page read and write
E98000
trusted library allocation
page read and write
C5E000
stack
page read and write
6F40000
trusted library allocation
page read and write
5160000
heap
page execute and read and write
4EF4000
trusted library section
page readonly
F70000
heap
page read and write
48AF000
trusted library allocation
page read and write
1796000
trusted library allocation
page read and write
2A60000
trusted library allocation
page read and write
D40000
heap
page read and write
3010000
heap
page read and write
318F000
unkown
page read and write
16CE000
stack
page read and write
3220000
trusted library allocation
page read and write
BDD000
trusted library allocation
page execute and read and write
9FEE000
stack
page read and write
3E80000
trusted library allocation
page read and write
A50000
heap
page read and write
59B0000
trusted library section
page read and write
138B000
trusted library allocation
page execute and read and write
332E000
stack
page read and write
2A86000
trusted library allocation
page read and write
2D7D000
stack
page read and write
A00000
heap
page read and write
7F7E000
stack
page read and write
13A0000
trusted library allocation
page read and write
5130000
trusted library allocation
page read and write
7A7000
stack
page read and write
737E000
stack
page read and write
3B21000
trusted library allocation
page read and write
5730000
trusted library allocation
page execute and read and write
83C000
stack
page read and write
32F9000
trusted library allocation
page read and write
133E000
stack
page read and write
31FB000
heap
page read and write
3FF5000
trusted library allocation
page read and write
B23B000
stack
page read and write
1BD000
stack
page read and write
F18000
heap
page read and write
11A0000
trusted library allocation
page read and write
314E000
unkown
page read and write
C80000
trusted library allocation
page execute and read and write
1750000
trusted library allocation
page read and write
4F10000
heap
page read and write
AC10000
heap
page read and write
460000
heap
page read and write
5710000
trusted library allocation
page read and write
2EBE000
stack
page read and write
5960000
heap
page read and write
CD0000
heap
page read and write
5CA0000
trusted library allocation
page read and write
136D000
trusted library allocation
page execute and read and write
D10000
heap
page read and write
3210000
trusted library allocation
page read and write
1354000
trusted library allocation
page read and write
6D40000
heap
page read and write
5940000
heap
page read and write
535B000
stack
page read and write
7D4E000
stack
page read and write
4E70000
heap
page read and write
7F3E000
stack
page read and write
A80000
heap
page read and write
3030000
heap
page read and write
7A50000
trusted library allocation
page read and write
11B7000
heap
page read and write
474000
remote allocation
page execute and read and write
50FB000
stack
page read and write
5D0000
heap
page read and write
D82000
unkown
page readonly
2BC3000
trusted library allocation
page read and write
2A8D000
trusted library allocation
page read and write
7360000
trusted library allocation
page read and write
5120000
heap
page read and write
7A90000
trusted library allocation
page read and write
BCD000
trusted library allocation
page execute and read and write
FCE000
stack
page read and write
62B0000
heap
page read and write
7860000
heap
page read and write
9EAE000
stack
page read and write
5A60000
trusted library allocation
page read and write
F35000
heap
page read and write
6279000
heap
page read and write
62AC000
heap
page read and write
776C000
heap
page read and write
2A6B000
trusted library allocation
page read and write
62A000
heap
page read and write
6270000
heap
page read and write
1730000
heap
page read and write
7FBE000
stack
page read and write
17A2000
trusted library allocation
page read and write
474000
remote allocation
page execute and read and write
5990000
trusted library allocation
page read and write
6AA000
stack
page read and write
BF7000
trusted library allocation
page execute and read and write
13F4000
heap
page read and write
2FBF000
stack
page read and write
A12C000
stack
page read and write
61E000
stack
page read and write
6F3E000
trusted library allocation
page read and write
177B000
trusted library allocation
page read and write
BC4000
trusted library allocation
page read and write
BE6000
trusted library allocation
page execute and read and write
31F0000
heap
page read and write
1433000
heap
page read and write
4ED0000
trusted library allocation
page read and write
13C0000
heap
page read and write
3F3B000
trusted library allocation
page read and write
2ABF000
stack
page read and write
1FA000
stack
page read and write
59C0000
heap
page execute and read and write
B95000
heap
page read and write
5C20000
heap
page read and write
F27000
heap
page read and write
1774000
trusted library allocation
page read and write
BF2000
trusted library allocation
page read and write
29BC000
stack
page read and write
5329000
trusted library allocation
page read and write
BE0000
trusted library allocation
page read and write
2AB0000
trusted library allocation
page read and write
3215000
trusted library allocation
page read and write
3E3E000
trusted library allocation
page read and write
AC00000
heap
page read and write
5340000
heap
page read and write
2AFC000
stack
page read and write
1360000
trusted library allocation
page read and write
AE7E000
stack
page read and write
1760000
heap
page read and write
AE0000
heap
page read and write
FE0000
heap
page read and write
A96E000
stack
page read and write
4EC0000
trusted library allocation
page execute and read and write
1363000
trusted library allocation
page read and write
FD0000
heap
page read and write
9BCE000
stack
page read and write
470000
heap
page read and write
2AB5000
trusted library allocation
page read and write
387E000
stack
page read and write
A9AE000
stack
page read and write
1372000
trusted library allocation
page read and write
E5E000
stack
page read and write
42B7000
trusted library allocation
page read and write
F09000
stack
page read and write
137A000
trusted library allocation
page execute and read and write
4FEF000
trusted library allocation
page read and write
345F000
stack
page read and write
13C8000
heap
page read and write
4ED4000
trusted library allocation
page read and write
1180000
heap
page execute and read and write
13FF000
heap
page read and write
4261000
trusted library allocation
page read and write
7382000
trusted library allocation
page read and write
C90000
heap
page read and write
6F60000
trusted library allocation
page execute and read and write
1791000
trusted library allocation
page read and write
B33C000
stack
page read and write
56E2000
trusted library allocation
page read and write
A36E000
stack
page read and write
135D000
trusted library allocation
page execute and read and write
4E8B000
trusted library allocation
page read and write
18CE000
stack
page read and write
2B10000
heap
page read and write
7330000
trusted library allocation
page execute and read and write
7868000
heap
page read and write
2EAA000
trusted library allocation
page read and write
7A60000
trusted library allocation
page read and write
5C25000
heap
page read and write
5320000
trusted library allocation
page read and write
5A50000
trusted library allocation
page execute and read and write
4EA0000
trusted library allocation
page read and write
4EF0000
trusted library section
page readonly
D3E000
heap
page read and write
AD3E000
stack
page read and write
1376000
trusted library allocation
page execute and read and write
3240000
trusted library allocation
page read and write
C98000
heap
page read and write
2DB9000
stack
page read and write
11B0000
heap
page read and write
C10000
trusted library allocation
page read and write
BD0000
trusted library allocation
page read and write
A87000
heap
page read and write
579B000
stack
page read and write
F30000
heap
page read and write
6C3E000
stack
page read and write
2A5B000
stack
page read and write
3178000
trusted library allocation
page read and write
58E000
unkown
page read and write
AFBE000
stack
page read and write
3250000
heap
page execute and read and write
D45000
heap
page read and write
6260000
heap
page read and write
2A92000
trusted library allocation
page read and write
80BE000
stack
page read and write
56E0000
trusted library allocation
page read and write
C9E000
heap
page read and write
D20000
heap
page read and write
17C7000
heap
page read and write
296F000
stack
page read and write
1479000
heap
page read and write
F80000
heap
page read and write
2A7E000
trusted library allocation
page read and write
13E7000
heap
page read and write
B6D000
stack
page read and write
1340000
trusted library allocation
page read and write
1370000
trusted library allocation
page read and write
1190000
trusted library allocation
page read and write
5C0D000
stack
page read and write
9A8E000
stack
page read and write
5310000
trusted library allocation
page execute and read and write
B0FE000
stack
page read and write
7C30000
trusted library section
page read and write
471000
remote allocation
page execute and read and write
7A80000
trusted library allocation
page execute and read and write
B90000
heap
page read and write
3319000
trusted library allocation
page read and write
5322000
trusted library allocation
page read and write
56F0000
heap
page read and write
316E000
stack
page read and write
BC0000
trusted library allocation
page read and write
B1FE000
stack
page read and write
11A4000
trusted library allocation
page read and write
1353000
trusted library allocation
page execute and read and write
6D3E000
stack
page read and write
54D0000
trusted library allocation
page read and write
179D000
trusted library allocation
page read and write
9BC000
stack
page read and write
A26E000
stack
page read and write
117B000
stack
page read and write
16D0000
trusted library allocation
page read and write
A86D000
stack
page read and write
4E80000
trusted library allocation
page read and write
6A90000
heap
page read and write
970000
heap
page read and write
2970000
heap
page read and write
113E000
stack
page read and write
ED0000
heap
page read and write
BE2000
trusted library allocation
page read and write
3FB3000
trusted library allocation
page read and write
397F000
stack
page read and write
1461000
heap
page read and write
998E000
stack
page read and write
4E90000
trusted library allocation
page execute and read and write
D58000
heap
page read and write
1405000
heap
page read and write
142B000
heap
page read and write
3DC5000
trusted library allocation
page read and write
F45000
heap
page read and write
BC3000
trusted library allocation
page execute and read and write
D80000
unkown
page readonly
BD3000
trusted library allocation
page read and write
168E000
stack
page read and write
EA0000
heap
page read and write
9E6E000
stack
page read and write
1387000
trusted library allocation
page execute and read and write
11A6000
trusted library allocation
page read and write
2A64000
trusted library allocation
page read and write
BEA000
trusted library allocation
page execute and read and write
1770000
trusted library allocation
page read and write
5700000
trusted library allocation
page execute and read and write
E8F000
stack
page read and write
4269000
trusted library allocation
page read and write
4F23000
heap
page read and write
1382000
trusted library allocation
page read and write
5740000
trusted library allocation
page read and write
There are 343 hidden memdumps, click here to show them.