IOC Report
https://www.bnaminexg.com/Invoice-yetdr.zip

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img
UDF filesystem data (version 1.5) 'DOCUMENTS'
dropped
 malicious
C:\Users\user\Downloads\Invoice-yetdr.zip (copy)
Zip multi-volume archive data, at least PKZIP v2.50 to extract
dropped
 malicious
\Device\CdRom1\63534464.vbs
Unicode text, UTF-16, little-endian text, with very long lines (458), with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ioh3rww.fya.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l1xh3w2v.gsq.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ql12fcc5.1tp.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_qmpijqgg.0no.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\unarchiver.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\Downloads\Invoice-yetdr.zip.crdownload
Zip multi-volume archive data, at least PKZIP v2.50 to extract
dropped
Chrome Cache Entry: 57
Zip multi-volume archive data, at least PKZIP v2.50 to extract
downloaded
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
 malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1936,i,14102734953510180185,6557037327749919800,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.bnaminexg.com/Invoice-yetdr.zip"
 malicious
C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /c powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ex bypass -command Mount-DiskImage -ImagePath "C:\Users\user\AppData\Local\Temp\vqyu22il.thm\Invoice-yetdr.img"
 malicious
C:\Windows\SysWOW64\unarchiver.exe
"C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\Invoice-yetdr.zip"
C:\Windows\SysWOW64\7za.exe
"C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\vqyu22il.thm" "C:\Users\user\Downloads\Invoice-yetdr.zip"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\notepad.exe
"C:\Windows\system32\NOTEPAD.EXE" D:\autorun.inf

URLs

Name
IP
Malicious
https://www.bnaminexg.com/Invoice-yetdr.zip
malicious
https://www.bnaminexg.com/Invoice-yetdr.zip
162.210.199.135
 malicious
https://pastebin.com/raw/vHQdp1zj
unknown

Domains

Name
IP
Malicious
bnaminexg.com
162.210.199.135
www.google.com
142.250.184.228
www.bnaminexg.com
unknown

IPs

IP
Domain
Country
Malicious
239.255.255.250
unknown
Reserved
162.210.199.135
bnaminexg.com
United States
142.250.184.228
www.google.com
United States
192.168.2.6
unknown
unknown

Registry

Path
Value
Malicious
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\NOTEPAD.EXE.FriendlyAppName
HKEY_CURRENT_USER_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
C:\Windows\system32\NOTEPAD.EXE.ApplicationCompany
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Notepad
fWindowsOnlyEOL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Notepad
fPasteOriginalEOL
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Notepad
fReverse
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Notepad
fWrapAround
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Notepad
fMatchCase

Memdumps

Base Address
Regiontype
Protect
Malicious
F2B000
heap
page read and write
309C000
trusted library allocation
page read and write
13E0000
heap
page read and write
1330000
trusted library allocation
page read and write
1470000
heap
page read and write
FCD000
heap
page read and write
30B0000
trusted library allocation
page read and write
311E000
trusted library allocation
page read and write
5B9D000
stack
page read and write
30EE000
trusted library allocation
page read and write
F89000
heap
page read and write
12AE000
stack
page read and write
53EE000
stack
page read and write
2DC3000
heap
page read and write
4CA0000
trusted library allocation
page read and write
52AD000
stack
page read and write
3145000
heap
page read and write
1478000
heap
page read and write
3061000
trusted library allocation
page read and write
30FF000
trusted library allocation
page read and write
313A000
heap
page read and write
2E0F000
stack
page read and write
12B0000
heap
page read and write
3154000
heap
page read and write
FAC000
heap
page read and write
2F10000
trusted library allocation
page read and write
1440000
trusted library allocation
page execute and read and write
310A000
trusted library allocation
page read and write
12C0000
trusted library allocation
page read and write
52C0000
heap
page read and write
2B5D000
stack
page read and write
3076000
stack
page read and write
1465000
heap
page read and write
60AE000
stack
page read and write
309E000
stack
page read and write
2DC4000
heap
page read and write
6560000
heap
page read and write
30FC000
trusted library allocation
page read and write
1352000
trusted library allocation
page execute and read and write
5C9F000
stack
page read and write
1367000
trusted library allocation
page execute and read and write
1430000
trusted library allocation
page read and write
4ECF000
stack
page read and write
313D000
heap
page read and write
30A0000
heap
page read and write
1460000
heap
page execute and read and write
13AE000
stack
page read and write
12E0000
trusted library allocation
page read and write
31D0000
heap
page read and write
10FD000
stack
page read and write
132A000
trusted library allocation
page execute and read and write
3410000
heap
page read and write
4DC0000
heap
page read and write
4DB9000
heap
page read and write
1470000
heap
page read and write
30CC000
trusted library allocation
page read and write
3104000
trusted library allocation
page read and write
5F6E000
stack
page read and write
7F1F0000
trusted library allocation
page execute and read and write
BB9000
stack
page read and write
1478000
heap
page read and write
32B5000
heap
page read and write
E10000
heap
page read and write
30E1000
trusted library allocation
page read and write
FA3000
heap
page read and write
2A5D000
stack
page read and write
FC1000
heap
page read and write
2DAC000
heap
page read and write
576F000
stack
page read and write
30EB000
trusted library allocation
page read and write
52E0000
heap
page read and write
6DE0000
trusted library allocation
page read and write
1332000
trusted library allocation
page execute and read and write
51FE000
stack
page read and write
2D1E000
stack
page read and write
4F4F000
stack
page read and write
2DC6000
heap
page read and write
5900000
heap
page read and write
3107000
trusted library allocation
page read and write
53AD000
stack
page read and write
F2E000
heap
page read and write
133C000
trusted library allocation
page execute and read and write
315A000
heap
page read and write
4DB0000
heap
page read and write
30DE000
trusted library allocation
page read and write
3162000
heap
page read and write
12E0000
heap
page read and write
4061000
trusted library allocation
page read and write
2F9F000
unkown
page read and write
6DD0000
trusted library allocation
page read and write
2BC0000
heap
page read and write
30B5000
trusted library allocation
page read and write
1130000
heap
page read and write
BB6000
stack
page read and write
30AA000
trusted library allocation
page read and write
5770000
trusted library allocation
page read and write
F10000
heap
page read and write
3135000
heap
page read and write
5A4E000
stack
page read and write
1250000
heap
page read and write
606E000
stack
page read and write
142E000
stack
page read and write
4E8E000
stack
page read and write
FC4000
heap
page read and write
30C4000
trusted library allocation
page read and write
135A000
trusted library allocation
page execute and read and write
2D2E000
stack
page read and write
3110000
trusted library allocation
page read and write
F9F000
heap
page read and write
2CA0000
heap
page read and write
313E000
heap
page read and write
E15000
heap
page read and write
1322000
trusted library allocation
page execute and read and write
ABC000
stack
page read and write
2DA0000
heap
page read and write
4F74000
heap
page read and write
1360000
trusted library allocation
page read and write
2E10000
heap
page read and write
12F0000
heap
page read and write
30E4000
trusted library allocation
page read and write
30C1000
trusted library allocation
page read and write
3115000
trusted library allocation
page read and write
4DB6000
heap
page read and write
313D000
heap
page read and write
4E0E000
stack
page read and write
3090000
trusted library allocation
page read and write
BBB000
stack
page read and write
F5E000
heap
page read and write
32B0000
heap
page read and write
4E4E000
stack
page read and write
10D0000
heap
page read and write
4F0E000
stack
page read and write
124E000
stack
page read and write
133A000
trusted library allocation
page execute and read and write
562E000
stack
page read and write
54ED000
stack
page read and write
2CEE000
unkown
page read and write
3118000
trusted library allocation
page read and write
F47000
heap
page read and write
30BB000
stack
page read and write
3220000
heap
page read and write
2D30000
heap
page read and write
566E000
stack
page read and write
3110000
heap
page read and write
3118000
heap
page read and write
552D000
stack
page read and write
30CF000
trusted library allocation
page read and write
3112000
trusted library allocation
page read and write
DCC000
stack
page read and write
13FF000
stack
page read and write
1460000
heap
page read and write
E30000
heap
page read and write
4F70000
heap
page read and write
310E000
trusted library allocation
page read and write
61AE000
stack
page read and write
136B000
trusted library allocation
page execute and read and write
F20000
heap
page read and write
5B4E000
stack
page read and write
1310000
trusted library allocation
page read and write
There are 149 hidden memdumps, click here to show them.