IOC Report
proof of payment.exe

loading gif

Files

File Path
Type
Category
Malicious
proof of payment.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\remcos\logs.dat
data
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmpCCF4.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\NvbYSEq.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NvbYSEq.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\proof of payment.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WDKI0JR2\json[1].json
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_awqileim.5v0.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_smkerehp.vro.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xoz05yv4.zfh.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zwvdb22p.hvf.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\bhv58.tmp
Extensible storage engine DataBase, version 0x620, checksum 0x0155ffb7, page size 32768, DirtyShutdown, Windows version 10.0
dropped
C:\Users\user\AppData\Local\Temp\tmpE166.tmp
XML 1.0 document, ASCII text
dropped
C:\Users\user\AppData\Local\Temp\uevjjogtpiaq
Unicode text, UTF-16, little-endian text, with no line terminators
dropped
C:\Users\user\AppData\Roaming\NvbYSEq.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
There are 6 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\proof of payment.exe
"C:\Users\user\Desktop\proof of payment.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\NvbYSEq.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NvbYSEq" /XML "C:\Users\user\AppData\Local\Temp\tmpCCF4.tmp"
 malicious
C:\Users\user\Desktop\proof of payment.exe
"C:\Users\user\Desktop\proof of payment.exe"
 malicious
C:\Users\user\AppData\Roaming\NvbYSEq.exe
C:\Users\user\AppData\Roaming\NvbYSEq.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NvbYSEq" /XML "C:\Users\user\AppData\Local\Temp\tmpE166.tmp"
 malicious
C:\Users\user\AppData\Roaming\NvbYSEq.exe
"C:\Users\user\AppData\Roaming\NvbYSEq.exe"
 malicious
C:\Users\user\Desktop\proof of payment.exe
"C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\uevjjogtpiaq"
 malicious
C:\Users\user\Desktop\proof of payment.exe
"C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\eyacchqudqsuyhp"
 malicious
C:\Users\user\Desktop\proof of payment.exe
"C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\eyacchqudqsuyhp"
 malicious
C:\Users\user\Desktop\proof of payment.exe
"C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\pbfmdzborykhjndcrx"
 malicious
C:\Users\user\Desktop\proof of payment.exe
"C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\pbfmdzborykhjndcrx"
 malicious
C:\Users\user\Desktop\proof of payment.exe
"C:\Users\user\Desktop\proof of payment.exe" /stext "C:\Users\user\AppData\Local\Temp\pbfmdzborykhjndcrx"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 7 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://geoplugin.net/json.gp
178.237.33.50
 malicious
37.120.235.122
malicious
http://geoplugin.net/json.gp/C
unknown
 malicious
https://www.google.com
unknown
http://www.imvu.comr
unknown
http://www.imvu.com
unknown
http://geoplugin.net/json.gp2
unknown
https://www.google.com/accounts/servicelogin
unknown
https://login.yahoo.com/config/login
unknown
http://geoplugin.net/json.gpOw
unknown
http://www.nirsoft.net
unknown
http://www.nirsoft.net/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://www.imvu.comhttp://www.ebuddy.comhttps://www.google.com
unknown
http://geoplugin.net/json.gp_
unknown
http://www.ebuddy.com
unknown
There are 6 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
geoplugin.net
178.237.33.50

IPs

IP
Domain
Country
Malicious
37.120.235.122
unknown
Romania
malicious
178.237.33.50
geoplugin.net
Netherlands

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-F9KCYW
exepath
HKEY_CURRENT_USER\SOFTWARE\Rmc-F9KCYW
licence
HKEY_CURRENT_USER\SOFTWARE\Rmc-F9KCYW
time

Memdumps

Base Address
Regiontype
Protect
Malicious
3854000
trusted library allocation
page read and write
 malicious
30CF000
stack
page read and write
 malicious
15EA000
heap
page read and write
 malicious
389E000
trusted library allocation
page read and write
 malicious
3837000
trusted library allocation
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
E57000
heap
page read and write
 malicious
5130000
trusted library section
page read and write
 malicious
1567000
heap
page read and write
 malicious
4C9B000
stack
page read and write
917000
heap
page read and write
7FC000
stack
page read and write
302F000
stack
page read and write
8B3000
trusted library allocation
page read and write
2D8E000
stack
page read and write
4A80000
trusted library allocation
page read and write
8A4000
trusted library allocation
page read and write
674E000
heap
page read and write
C60000
trusted library allocation
page read and write
DA0000
heap
page read and write
1450000
heap
page read and write
456000
system
page execute and read and write
24D9000
stack
page read and write
4AA1000
heap
page read and write
257A000
heap
page read and write
26A8000
trusted library allocation
page read and write
35A9000
trusted library allocation
page read and write
113B000
stack
page read and write
911000
heap
page read and write
400000
system
page execute and read and write
D60000
heap
page execute and read and write
2860000
heap
page read and write
4E40000
heap
page execute and read and write
D4C000
stack
page read and write
1DF000
unkown
page read and write
1458000
heap
page read and write
9EFD000
stack
page read and write
1090000
heap
page read and write
2D2E000
stack
page read and write
14A0000
heap
page read and write
276A000
trusted library allocation
page read and write
24F0000
heap
page read and write
4B4B000
trusted library allocation
page read and write
95CE000
stack
page read and write
9D5000
heap
page read and write
6F72000
trusted library allocation
page read and write
4A8B000
trusted library allocation
page read and write
15DE000
heap
page read and write
12AE000
stack
page read and write
13DF000
stack
page read and write
4AA1000
trusted library allocation
page read and write
3A49000
heap
page read and write
5140000
trusted library allocation
page read and write
698E000
heap
page read and write
4AF0000
trusted library allocation
page read and write
7460000
heap
page read and write
459000
system
page execute and read and write
4B44000
trusted library allocation
page read and write
10001000
direct allocation
page execute and read and write
2930000
heap
page read and write
2B94000
trusted library allocation
page read and write
26CF000
stack
page read and write
1E0000
heap
page read and write
9CC000
heap
page read and write
2D2000
unkown
page readonly
9C2000
stack
page read and write
6910000
trusted library allocation
page execute and read and write
C20000
heap
page read and write
4A9E000
trusted library allocation
page read and write
9A0E000
stack
page read and write
69DE000
stack
page read and write
2650000
heap
page read and write
1550000
heap
page read and write
98D000
trusted library allocation
page execute and read and write
3693000
trusted library allocation
page read and write
2D40000
heap
page read and write
4AB2000
trusted library allocation
page read and write
45C000
system
page execute and read and write
2980000
heap
page read and write
906000
heap
page read and write
6870000
heap
page read and write
A4D000
heap
page read and write
9D7C000
stack
page read and write
36A000
stack
page read and write
9EBE000
stack
page read and write
478000
remote allocation
page execute and read and write
A3BC000
stack
page read and write
4B40000
trusted library allocation
page read and write
9AB000
stack
page read and write
14EC000
stack
page read and write
4AAD000
trusted library allocation
page read and write
2D0E000
stack
page read and write
2661000
trusted library allocation
page read and write
80D000
stack
page read and write
474000
remote allocation
page execute and read and write
6850000
trusted library allocation
page read and write
4F00000
trusted library section
page read and write
45A8000
trusted library allocation
page read and write
11F0000
heap
page read and write
288F000
heap
page read and write
990000
trusted library allocation
page read and write
6A1E000
stack
page read and write
757000
stack
page read and write
825000
heap
page read and write
4C10000
trusted library allocation
page read and write
4B30000
heap
page read and write
119C000
stack
page read and write
41B000
system
page execute and read and write
2780000
heap
page read and write
15E6000
heap
page read and write
3705000
trusted library allocation
page read and write
3753000
trusted library allocation
page read and write
4800000
heap
page read and write
28A1000
heap
page read and write
3D0000
heap
page read and write
8C6000
trusted library allocation
page execute and read and write
15C8000
heap
page read and write
C90000
heap
page read and write
32FF000
stack
page read and write
A58000
heap
page read and write
31CF000
stack
page read and write
A43000
heap
page read and write
37DF000
trusted library allocation
page read and write
68F9000
trusted library allocation
page read and write
28F3000
trusted library allocation
page read and write
6976000
heap
page read and write
5150000
trusted library allocation
page execute and read and write
4B40000
trusted library allocation
page read and write
CA7000
trusted library allocation
page execute and read and write
68F0000
trusted library allocation
page read and write
32CF000
stack
page read and write
A5FF000
stack
page read and write
D90000
trusted library allocation
page read and write
4CA0000
trusted library section
page readonly
3A76000
heap
page read and write
4B90000
trusted library allocation
page read and write
57A0000
heap
page read and write
8F9000
heap
page read and write
5780000
heap
page read and write
51B0000
trusted library allocation
page read and write
7482000
heap
page read and write
68EE000
stack
page read and write
BB2000
trusted library allocation
page read and write
358E000
stack
page read and write
29B8000
trusted library allocation
page read and write
9C4F000
stack
page read and write
4BB0000
trusted library allocation
page read and write
CBE000
stack
page read and write
C84000
trusted library allocation
page read and write
2570000
heap
page read and write
A0CE000
stack
page read and write
4D80000
heap
page read and write
8CA000
trusted library allocation
page execute and read and write
471000
remote allocation
page execute and read and write
3320000
heap
page read and write
4B60000
trusted library allocation
page read and write
257B000
stack
page read and write
2FAF000
stack
page read and write
CB0000
heap
page read and write
4C00000
heap
page read and write
CAE000
stack
page read and write
6E5D000
stack
page read and write
47FC000
stack
page read and write
10BD000
heap
page read and write
9C4000
stack
page read and write
5000000
heap
page read and write
C70000
heap
page read and write
C6D000
stack
page read and write
4F30000
heap
page execute and read and write
A10E000
stack
page read and write
CA2000
trusted library allocation
page read and write
400000
system
page execute and read and write
970000
trusted library allocation
page read and write
26AA000
trusted library allocation
page read and write
400000
system
page execute and read and write
FA8000
heap
page read and write
913000
heap
page read and write
5120000
trusted library section
page read and write
D80000
trusted library allocation
page read and write
9C00000
trusted library allocation
page read and write
4AD0000
trusted library allocation
page read and write
5100000
heap
page read and write
3C0000
heap
page read and write
96E000
stack
page read and write
968000
heap
page read and write
A27000
heap
page read and write
15BE000
heap
page read and write
4840000
heap
page read and write
15B5000
heap
page read and write
1410000
heap
page read and write
870000
heap
page read and write
385E000
trusted library allocation
page read and write
4B42000
trusted library allocation
page read and write
9F8E000
stack
page read and write
149E000
stack
page read and write
2880000
heap
page read and write
4F4D000
stack
page read and write
150000
heap
page read and write
12B0000
heap
page read and write
2F4F000
stack
page read and write
4668000
trusted library allocation
page read and write
8B0000
trusted library allocation
page read and write
4C03000
heap
page read and write
7FE000
stack
page read and write
3B2E000
trusted library allocation
page read and write
379E000
trusted library allocation
page read and write
6C2E000
stack
page read and write
2BA0000
heap
page read and write
92E000
stack
page read and write
5010000
heap
page read and write
6B3E000
stack
page read and write
31AF000
stack
page read and write
4EC0000
heap
page read and write
6990000
trusted library allocation
page execute and read and write
984000
trusted library allocation
page read and write
517E000
stack
page read and write
8D0000
heap
page read and write
4A97000
trusted library allocation
page read and write
26E0000
heap
page read and write
4BD0000
heap
page read and write
1620000
heap
page read and write
109C000
stack
page read and write
5105000
heap
page read and write
474000
remote allocation
page execute and read and write
12D0000
heap
page read and write
26AF000
stack
page read and write
A210000
heap
page read and write
F8F000
stack
page read and write
4BF0000
heap
page read and write
6978000
heap
page read and write
BBB000
trusted library allocation
page execute and read and write
7A0000
heap
page read and write
503D000
stack
page read and write
4AA7000
trusted library allocation
page read and write
CDE000
heap
page read and write
74B1000
heap
page read and write
162B000
heap
page read and write
4F20000
heap
page read and write
2DB0000
heap
page read and write
4D70000
trusted library section
page readonly
6E7E000
stack
page read and write
12C0000
heap
page read and write
4D90000
heap
page read and write
FBF000
heap
page read and write
BA0000
trusted library allocation
page read and write
152C000
stack
page read and write
15A4000
heap
page read and write
C40000
heap
page read and write
10000000
direct allocation
page read and write
9AA000
heap
page read and write
B9F000
stack
page read and write
B50000
heap
page read and write
A600000
trusted library allocation
page read and write
983000
trusted library allocation
page execute and read and write
C80000
trusted library allocation
page read and write
108E000
stack
page read and write
45D000
system
page execute and read and write
6A30000
trusted library section
page read and write
BA6000
trusted library allocation
page execute and read and write
103C000
stack
page read and write
4C12000
trusted library allocation
page read and write
2897000
heap
page read and write
696D000
heap
page read and write
4B72000
trusted library allocation
page read and write
260E000
unkown
page read and write
9BF000
stack
page read and write
4EE0000
trusted library allocation
page execute and read and write
4A84000
trusted library allocation
page read and write
91A000
heap
page read and write
E6E000
stack
page read and write
A4BC000
stack
page read and write
9E8E000
stack
page read and write
4B6D000
trusted library allocation
page read and write
B9E000
stack
page read and write
5100000
trusted library allocation
page read and write
8BD000
trusted library allocation
page execute and read and write
C77000
heap
page read and write
6B2E000
stack
page read and write
264E000
stack
page read and write
4AC5000
trusted library allocation
page read and write
9DBD000
stack
page read and write
473B000
stack
page read and write
9C7B000
stack
page read and write
5170000
trusted library allocation
page execute and read and write
2AD4000
trusted library allocation
page read and write
43E000
stack
page read and write
4FF5000
heap
page read and write
A20E000
stack
page read and write
990000
heap
page read and write
473000
system
page execute and read and write
CF7000
heap
page read and write
5180000
trusted library allocation
page read and write
9D60000
heap
page read and write
97D0000
heap
page read and write
6946000
heap
page read and write
2D4E000
stack
page read and write
344E000
stack
page read and write
9AE000
heap
page read and write
E70000
heap
page read and write
2580000
trusted library allocation
page read and write
5160000
trusted library allocation
page read and write
6940000
heap
page read and write
288C000
heap
page read and write
354F000
stack
page read and write
9DF000
heap
page read and write
DA000
stack
page read and write
6860000
trusted library allocation
page execute and read and write
4B50000
trusted library allocation
page execute and read and write
4DB0000
heap
page read and write
993000
trusted library allocation
page read and write
4FF0000
heap
page read and write
9B0E000
stack
page read and write
4ED0000
heap
page read and write
440F000
stack
page read and write
96D000
heap
page read and write
AFC000
stack
page read and write
3A74000
trusted library allocation
page read and write
7B0000
heap
page read and write
96CE000
stack
page read and write
1557000
heap
page read and write
1440000
heap
page read and write
4A94000
trusted library allocation
page read and write
E20000
heap
page read and write
8C0000
trusted library allocation
page read and write
FA0000
heap
page read and write
BB7000
trusted library allocation
page execute and read and write
9A4E000
stack
page read and write
30AF000
stack
page read and write
68A0000
trusted library allocation
page read and write
10016000
direct allocation
page execute and read and write
D70000
trusted library allocation
page read and write
4AB0000
trusted library allocation
page read and write
65A000
stack
page read and write
4C20000
trusted library allocation
page execute and read and write
1560000
heap
page read and write
8AD000
trusted library allocation
page execute and read and write
9FCD000
stack
page read and write
6979000
trusted library allocation
page read and write
C70000
heap
page read and write
36B7000
trusted library allocation
page read and write
5770000
heap
page read and write
CC0000
heap
page read and write
99D000
trusted library allocation
page execute and read and write
3661000
trusted library allocation
page read and write
C9E000
stack
page read and write
ACC000
stack
page read and write
6840000
trusted library allocation
page execute and read and write
368F000
stack
page read and write
268E000
stack
page read and write
2768000
trusted library allocation
page read and write
4A90000
trusted library allocation
page read and write
C86000
trusted library allocation
page read and write
6970000
trusted library allocation
page read and write
7489000
heap
page read and write
26D0000
heap
page read and write
9A6000
stack
page read and write
99CE000
stack
page read and write
BAA000
trusted library allocation
page execute and read and write
4BD3000
heap
page read and write
50EE000
stack
page read and write
4AC0000
trusted library allocation
page read and write
875000
heap
page read and write
744E000
stack
page read and write
1190000
heap
page read and write
2648000
trusted library allocation
page read and write
28F8000
trusted library allocation
page read and write
DEE000
stack
page read and write
9D4D000
stack
page read and write
CB5000
heap
page read and write
9D50000
heap
page read and write
97E0000
heap
page read and write
6D7E000
stack
page read and write
D50000
trusted library allocation
page execute and read and write
4B66000
trusted library allocation
page read and write
50F0000
trusted library allocation
page read and write
CAB000
trusted library allocation
page execute and read and write
E50000
heap
page read and write
43D000
stack
page read and write
6EBD000
stack
page read and write
F50000
heap
page read and write
39D0000
heap
page read and write
2A70000
heap
page read and write
2590000
heap
page execute and read and write
4D7F000
trusted library section
page readonly
4C30000
trusted library allocation
page read and write
6CFE000
stack
page read and write
4B5E000
trusted library allocation
page read and write
BCA000
stack
page read and write
6E1E000
stack
page read and write
820000
heap
page read and write
9A0000
heap
page read and write
A4FE000
stack
page read and write
25A1000
trusted library allocation
page read and write
BD0000
trusted library allocation
page read and write
83E000
stack
page read and write
2885000
heap
page read and write
4A40000
heap
page read and write
860000
heap
page read and write
9FFE000
stack
page read and write
4B61000
trusted library allocation
page read and write
4B80000
trusted library allocation
page read and write
97CD000
stack
page read and write
8A3000
trusted library allocation
page execute and read and write
C20000
heap
page read and write
2D0000
unkown
page readonly
8D8000
heap
page read and write
890000
trusted library allocation
page read and write
287D000
heap
page read and write
2880000
heap
page read and write
253E000
stack
page read and write
264F000
unkown
page read and write
C50000
trusted library allocation
page execute and read and write
8DE000
heap
page read and write
DA7000
heap
page read and write
CC8000
heap
page read and write
265C000
trusted library allocation
page read and write
4DA0000
trusted library allocation
page execute and read and write
5109000
trusted library allocation
page read and write
6D3E000
stack
page read and write
A70000
heap
page read and write
C1E000
stack
page read and write
119F000
stack
page read and write
288B000
heap
page read and write
6F7000
stack
page read and write
9E2000
heap
page read and write
19E000
unkown
page read and write
110000
heap
page read and write
9D000
stack
page read and write
35A1000
trusted library allocation
page read and write
10B0000
heap
page read and write
6740000
heap
page read and write
9B4E000
stack
page read and write
430E000
stack
page read and write
29B3000
trusted library allocation
page read and write
4B85000
trusted library allocation
page read and write
4BCB000
stack
page read and write
2F2E000
stack
page read and write
D0E000
stack
page read and write
104E000
stack
page read and write
CE0000
heap
page read and write
8CC000
stack
page read and write
31FE000
stack
page read and write
8A0000
trusted library allocation
page read and write
CC0000
trusted library allocation
page read and write
6EFE000
stack
page read and write
C6D000
stack
page read and write
747A000
heap
page read and write
39B9000
trusted library allocation
page read and write
980000
trusted library allocation
page read and write
94CE000
stack
page read and write
27B0000
heap
page read and write
3669000
trusted library allocation
page read and write
There are 442 hidden memdumps, click here to show them.