IOC Report
Payment Advice__Swift-MT103.pdf.bat.exe

loading gif

Files

File Path
Type
Category
Malicious
Payment Advice__Swift-MT103.pdf.bat.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Payment Advice__Swift-MT103.pdf.bat.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmp319C.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\PQHcRKfCm.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\PQHcRKfCm.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PQHcRKfCm.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\json[1].json
JSON data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_calkz5xu.qtz.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gwmnvu4c.4ut.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l4m1sisr.doi.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m5qythae.3o4.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n4cejotj.wpc.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tsteecit.dil.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uxpc05bu.1xp.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yuy2ahqh.b0p.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp4459.tmp
XML 1.0 document, ASCII text
dropped
There are 7 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Payment Advice__Swift-MT103.pdf.bat.exe
"C:\Users\user\Desktop\Payment Advice__Swift-MT103.pdf.bat.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Payment Advice__Swift-MT103.pdf.bat.exe"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\PQHcRKfCm.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PQHcRKfCm" /XML "C:\Users\user\AppData\Local\Temp\tmp319C.tmp"
 malicious
C:\Users\user\Desktop\Payment Advice__Swift-MT103.pdf.bat.exe
"C:\Users\user\Desktop\Payment Advice__Swift-MT103.pdf.bat.exe"
 malicious
C:\Users\user\Desktop\Payment Advice__Swift-MT103.pdf.bat.exe
"C:\Users\user\Desktop\Payment Advice__Swift-MT103.pdf.bat.exe"
 malicious
C:\Users\user\AppData\Roaming\PQHcRKfCm.exe
C:\Users\user\AppData\Roaming\PQHcRKfCm.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PQHcRKfCm" /XML "C:\Users\user\AppData\Local\Temp\tmp4459.tmp"
 malicious
C:\Users\user\AppData\Roaming\PQHcRKfCm.exe
"C:\Users\user\AppData\Roaming\PQHcRKfCm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 4 hidden processes, click here to show them.

URLs

Name
IP
Malicious
204.10.160.230
malicious
http://geoplugin.net/json.gp
178.237.33.50
http://geoplugin.net/json.gpH
unknown
http://geoplugin.net/R
unknown
http://geoplugin.net/json.gp/C
unknown
http://geoplugin.net/json.gpL
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://www.chiark.greenend.org.uk/~sgtatham/putty/0
unknown
http://geoplugin.net/json.gpSystem32
unknown

Domains

Name
IP
Malicious
geoplugin.net
178.237.33.50

IPs

IP
Domain
Country
Malicious
204.10.160.230
unknown
Canada
malicious
178.237.33.50
geoplugin.net
Netherlands

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-O7QOC3
exepath
 malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-O7QOC3
licence
 malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
42AA000
trusted library allocation
page read and write
 malicious
3B0B000
trusted library allocation
page read and write
 malicious
DFA000
heap
page read and write
 malicious
12BA000
heap
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
2A40000
trusted library allocation
page execute and read and write
28A5000
trusted library allocation
page read and write
5455000
heap
page read and write
3190000
trusted library allocation
page read and write
31A0000
trusted library allocation
page read and write
5C9E000
heap
page read and write
AF0000
trusted library allocation
page read and write
50CB000
stack
page read and write
2844000
trusted library allocation
page read and write
28BD000
stack
page read and write
28B0000
trusted library allocation
page read and write
7F300000
trusted library allocation
page execute and read and write
3140000
trusted library allocation
page read and write
2A80000
trusted library allocation
page read and write
B2A000
heap
page read and write
88E000
unkown
page read and write
B62000
heap
page read and write
2ED0000
trusted library allocation
page read and write
D20000
unkown
page readonly
AFD000
trusted library allocation
page execute and read and write
A1BE000
stack
page read and write
C5FF000
stack
page read and write
F77000
heap
page read and write
770000
heap
page read and write
73CE000
heap
page read and write
2880000
trusted library allocation
page read and write
4C1E000
trusted library allocation
page read and write
2A90000
heap
page execute and read and write
3548000
trusted library allocation
page read and write
C37C000
stack
page read and write
590000
heap
page read and write
B1A000
trusted library allocation
page execute and read and write
3241000
trusted library allocation
page read and write
1189D000
trusted library allocation
page read and write
107F000
stack
page read and write
58C0000
heap
page read and write
4269000
trusted library allocation
page read and write
284B000
trusted library allocation
page read and write
1882000
trusted library allocation
page read and write
1886000
trusted library allocation
page execute and read and write
B60000
heap
page read and write
5700000
heap
page read and write
784E000
stack
page read and write
2B6F000
stack
page read and write
5450000
heap
page read and write
5B70000
trusted library allocation
page read and write
29AF000
stack
page read and write
4A97000
trusted library allocation
page read and write
B12000
trusted library allocation
page read and write
2A20000
heap
page read and write
3080000
trusted library allocation
page read and write
2820000
trusted library allocation
page execute and read and write
12A0000
heap
page read and write
73B3000
heap
page read and write
5200000
heap
page read and write
E60000
heap
page read and write
780E000
stack
page read and write
B0D000
trusted library allocation
page execute and read and write
5AED000
stack
page read and write
34EF000
stack
page read and write
29FE000
stack
page read and write
70B0000
trusted library allocation
page execute and read and write
3060000
trusted library allocation
page read and write
4FD3000
heap
page read and write
13EB000
heap
page read and write
15B0000
trusted library allocation
page read and write
70A000
stack
page read and write
75DE000
stack
page read and write
1270000
heap
page read and write
122EE000
stack
page read and write
18B7000
heap
page read and write
2A66000
trusted library allocation
page read and write
8EC000
stack
page read and write
3AC9000
trusted library allocation
page read and write
5250000
heap
page execute and read and write
5690000
trusted library allocation
page execute and read and write
D22000
unkown
page readonly
3176000
trusted library allocation
page read and write
31C0000
trusted library allocation
page read and write
702E000
stack
page read and write
583C000
stack
page read and write
5B90000
heap
page read and write
6BAB000
heap
page read and write
6B60000
heap
page read and write
2850000
trusted library allocation
page read and write
57F000
unkown
page read and write
28D0000
trusted library allocation
page read and write
AA5000
heap
page read and write
13A9000
heap
page read and write
30DE000
stack
page read and write
BD6000
heap
page read and write
BCA000
heap
page read and write
1499000
heap
page read and write
4AE5000
trusted library allocation
page read and write
BB7000
heap
page read and write
3050000
heap
page read and write
AA0000
heap
page read and write
E62000
heap
page read and write
EAA000
stack
page read and write
16AE000
stack
page read and write
9EC000
stack
page read and write
1220000
heap
page read and write
43E000
unkown
page read and write
B16000
trusted library allocation
page execute and read and write
306E000
trusted library allocation
page read and write
B10000
trusted library allocation
page read and write
5D90000
trusted library section
page read and write
B4EE000
stack
page read and write
B54000
heap
page read and write
E3C000
heap
page read and write
1897000
trusted library allocation
page execute and read and write
15CD000
trusted library allocation
page execute and read and write
E10000
trusted library allocation
page read and write
5710000
heap
page read and write
5210000
trusted library allocation
page read and write
BFDE000
stack
page read and write
C0DE000
stack
page read and write
5460000
heap
page read and write
3090000
trusted library allocation
page read and write
EF0000
heap
page read and write
BB3000
heap
page read and write
7F9F0000
trusted library allocation
page execute and read and write
A13D000
stack
page read and write
BE9D000
stack
page read and write
5BC1000
heap
page read and write
448000
heap
page read and write
4393000
trusted library allocation
page read and write
B58C000
stack
page read and write
78B0000
trusted library allocation
page execute and read and write
189B000
trusted library allocation
page execute and read and write
2A30000
trusted library allocation
page read and write
15AE000
stack
page read and write
BD2000
heap
page read and write
57F0000
heap
page read and write
6EF000
stack
page read and write
57F3000
heap
page read and write
2890000
trusted library allocation
page read and write
FA7000
stack
page read and write
EE0000
heap
page read and write
7405000
heap
page read and write
4B33000
trusted library allocation
page read and write
292F000
unkown
page read and write
1F0000
heap
page read and write
BFC000
heap
page read and write
AF3000
trusted library allocation
page execute and read and write
759F000
stack
page read and write
76DE000
stack
page read and write
475000
remote allocation
page execute and read and write
315B000
trusted library allocation
page read and write
46E000
remote allocation
page execute and read and write
471000
remote allocation
page execute and read and write
15C3000
trusted library allocation
page execute and read and write
73DB000
heap
page read and write
333A000
trusted library allocation
page read and write
51F0000
heap
page read and write
DE7000
heap
page read and write
3171000
trusted library allocation
page read and write
E65000
heap
page read and write
73C8000
heap
page read and write
15C4000
trusted library allocation
page read and write
7710000
trusted library section
page read and write
B20000
heap
page read and write
C50000
heap
page read and write
AF4000
trusted library allocation
page read and write
126E000
stack
page read and write
BD50000
heap
page read and write
C3BD000
stack
page read and write
6FEE000
stack
page read and write
159E000
stack
page read and write
EBC000
stack
page read and write
33EE000
stack
page read and write
2FA0000
heap
page read and write
56D0000
trusted library allocation
page read and write
306A000
trusted library allocation
page read and write
BA4F000
stack
page read and write
73D6000
heap
page read and write
1200000
heap
page read and write
313B000
stack
page read and write
5B80000
heap
page read and write
29C0000
heap
page read and write
2870000
trusted library allocation
page read and write
301F000
stack
page read and write
DEF000
stack
page read and write
28F0000
heap
page read and write
2884000
trusted library allocation
page read and write
A9E000
stack
page read and write
6DDE000
stack
page read and write
51CE000
stack
page read and write
317D000
trusted library allocation
page read and write
123ED000
stack
page read and write
A00000
heap
page read and write
FBC000
stack
page read and write
5260000
heap
page read and write
FF0000
heap
page read and write
3220000
heap
page read and write
749E000
stack
page read and write
B2EE000
stack
page read and write
E9B000
stack
page read and write
E5A000
heap
page read and write
15C0000
trusted library allocation
page read and write
A534000
trusted library allocation
page read and write
BFF000
heap
page read and write
3020000
heap
page read and write
2872000
trusted library allocation
page read and write
2830000
trusted library allocation
page read and write
BD4D000
stack
page read and write
2C8A000
heap
page read and write
5240000
trusted library allocation
page read and write
70AD000
stack
page read and write
4249000
trusted library allocation
page read and write
440000
heap
page read and write
780000
heap
page read and write
147F000
heap
page read and write
C25000
heap
page read and write
3040000
trusted library allocation
page execute and read and write
33F0000
trusted library allocation
page read and write
2861000
trusted library allocation
page read and write
F30000
trusted library allocation
page read and write
31B0000
trusted library allocation
page read and write
149D000
heap
page read and write
D70000
heap
page read and write
DF2000
trusted library allocation
page read and write
BF9E000
stack
page read and write
2A60000
trusted library allocation
page read and write
2A1E000
stack
page read and write
120EE000
stack
page read and write
4B9C000
stack
page read and write
1444000
heap
page read and write
12A7000
heap
page read and write
76E0000
trusted library section
page read and write
6C7E000
stack
page read and write
6D7F000
stack
page read and write
C20000
heap
page read and write
79C2000
trusted library allocation
page read and write
A10000
heap
page read and write
6CD000
stack
page read and write
F35000
trusted library allocation
page read and write
2840000
trusted library allocation
page read and write
7A7000
stack
page read and write
135E000
stack
page read and write
BC4F000
stack
page read and write
1890000
trusted library allocation
page read and write
4FD0000
heap
page read and write
56B0000
trusted library allocation
page read and write
3182000
trusted library allocation
page read and write
3150000
trusted library allocation
page read and write
316E000
trusted library allocation
page read and write
1210000
heap
page read and write
E1E000
heap
page read and write
DE0000
heap
page read and write
1240000
heap
page read and write
4241000
trusted library allocation
page read and write
F06000
trusted library allocation
page read and write
DFB000
trusted library allocation
page execute and read and write
13D000
stack
page read and write
139E000
stack
page read and write
5C90000
heap
page read and write
2F1E000
stack
page read and write
1457000
heap
page read and write
1E0000
heap
page read and write
179000
stack
page read and write
144B000
heap
page read and write
33FB000
trusted library allocation
page read and write
2886000
trusted library allocation
page read and write
6A9000
stack
page read and write
3AA9000
trusted library allocation
page read and write
13E3000
heap
page read and write
F20000
trusted library allocation
page read and write
296E000
stack
page read and write
2BB1000
trusted library allocation
page read and write
3070000
trusted library allocation
page execute and read and write
2A60000
heap
page read and write
13A0000
heap
page read and write
28A0000
trusted library allocation
page read and write
DF7000
trusted library allocation
page execute and read and write
16EE000
stack
page read and write
5216000
trusted library allocation
page read and write
E60D000
stack
page read and write
5680000
trusted library allocation
page read and write
31B5000
trusted library allocation
page read and write
BC2000
heap
page read and write
B00000
trusted library allocation
page read and write
F10000
trusted library allocation
page execute and read and write
533C000
stack
page read and write
18B0000
heap
page read and write
A17E000
stack
page read and write
F0A000
trusted library allocation
page read and write
F0E000
trusted library allocation
page read and write
F00000
trusted library allocation
page read and write
EA0000
heap
page read and write
5580000
trusted library allocation
page read and write
57C0000
trusted library allocation
page read and write
B5CD000
stack
page read and write
E18000
unkown
page readonly
121EE000
stack
page read and write
31E0000
trusted library allocation
page read and write
2C80000
heap
page read and write
C4FE000
stack
page read and write
890000
heap
page read and write
2F00000
heap
page read and write
B3EE000
stack
page read and write
51E0000
heap
page read and write
188A000
trusted library allocation
page execute and read and write
125EE000
stack
page read and write
15DD000
trusted library allocation
page execute and read and write
59C0000
trusted library allocation
page read and write
76F0000
trusted library section
page read and write
73D9000
heap
page read and write
C4BE000
stack
page read and write
56F0000
trusted library section
page readonly
3180000
trusted library allocation
page read and write
3AA1000
trusted library allocation
page read and write
5270000
heap
page read and write
2BAF000
trusted library allocation
page read and write
E5E000
stack
page read and write
C27C000
stack
page read and write
2867000
trusted library allocation
page read and write
6AE000
stack
page read and write
E53000
heap
page read and write
2A70000
trusted library allocation
page execute and read and write
59E0000
heap
page execute and read and write
7700000
trusted library allocation
page read and write
2DB0000
heap
page read and write
AE0000
trusted library allocation
page read and write
2B63000
trusted library allocation
page read and write
285E000
trusted library allocation
page read and write
156F000
stack
page read and write
5B85000
heap
page read and write
5B60000
trusted library allocation
page execute and read and write
15D0000
trusted library allocation
page read and write
13E1000
heap
page read and write
1892000
trusted library allocation
page read and write
147D000
heap
page read and write
1245000
heap
page read and write
3096000
trusted library allocation
page read and write
1880000
trusted library allocation
page read and write
51D0000
trusted library section
page readonly
B47000
heap
page read and write
B2E000
heap
page read and write
56C0000
trusted library allocation
page execute and read and write
EC0000
trusted library allocation
page read and write
13CA000
heap
page read and write
F70000
heap
page read and write
7360000
heap
page read and write
471000
remote allocation
page execute and read and write
5570000
trusted library allocation
page execute and read and write
286D000
trusted library allocation
page read and write
56B6000
trusted library allocation
page read and write
A5E000
stack
page read and write
706E000
stack
page read and write
A000000
heap
page read and write
3230000
heap
page execute and read and write
15E0000
heap
page read and write
BD60000
heap
page read and write
F50000
heap
page read and write
BB4E000
stack
page read and write
5BA0000
heap
page read and write
6EDF000
stack
page read and write
124EC000
stack
page read and write
2AA1000
trusted library allocation
page read and write
13AE000
heap
page read and write
29BF000
stack
page read and write
There are 357 hidden memdumps, click here to show them.