IOC Report
SOA Payment for June 30th.exe

loading gif

Files

File Path
Type
Category
Malicious
SOA Payment for June 30th.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SOA Payment for June 30th.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SOA Payment for June 30th.exe
"C:\Users\user\Desktop\SOA Payment for June 30th.exe"
 malicious
C:\Users\user\Desktop\SOA Payment for June 30th.exe
"C:\Users\user\Desktop\SOA Payment for June 30th.exe"
 malicious

URLs

Name
IP
Malicious
http://nffplp.com
unknown
https://sectigo.com/CPS0
unknown
https://account.dyn.com/
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
http://tempuri.org/DataSet1.xsd
unknown
http://ip-api.com/line/?fields=hosting
208.95.112.1
http://ip-api.com
unknown

Domains

Name
IP
Malicious
ip-api.com
208.95.112.1
 malicious
nffplp.com
163.44.198.71
 malicious

IPs

IP
Domain
Country
Malicious
208.95.112.1
ip-api.com
United States
malicious
163.44.198.71
nffplp.com
Singapore
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SOA Payment for June 30th_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SOA Payment for June 30th_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SOA Payment for June 30th_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SOA Payment for June 30th_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SOA Payment for June 30th_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SOA Payment for June 30th_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SOA Payment for June 30th_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SOA Payment for June 30th_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SOA Payment for June 30th_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SOA Payment for June 30th_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SOA Payment for June 30th_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SOA Payment for June 30th_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SOA Payment for June 30th_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\SOA Payment for June 30th_RASMANCS
FileDirectory
There are 5 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
2DB1000
trusted library allocation
page read and write
 malicious
473E000
trusted library allocation
page read and write
 malicious
2E01000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
6FBE000
stack
page read and write
8A2000
unkown
page readonly
705E000
trusted library allocation
page read and write
2D06000
trusted library allocation
page read and write
4E5B000
stack
page read and write
12DE000
stack
page read and write
566D000
stack
page read and write
5200000
trusted library allocation
page read and write
64AE000
stack
page read and write
2B07000
trusted library allocation
page execute and read and write
56D0000
heap
page read and write
2BD0000
heap
page read and write
E40000
heap
page read and write
2DFD000
trusted library allocation
page read and write
2D01000
trusted library allocation
page read and write
6A60000
trusted library allocation
page read and write
F1E000
heap
page read and write
2B20000
trusted library allocation
page read and write
5386000
trusted library allocation
page read and write
2BC0000
trusted library allocation
page read and write
CF7000
stack
page read and write
1030000
trusted library allocation
page read and write
1080000
heap
page read and write
6990000
trusted library allocation
page read and write
5690000
heap
page read and write
5372000
trusted library allocation
page read and write
ECE000
stack
page read and write
52F0000
trusted library allocation
page execute and read and write
105B000
trusted library allocation
page execute and read and write
5220000
trusted library allocation
page read and write
12AE000
stack
page read and write
2BAC000
stack
page read and write
5560000
heap
page read and write
2CFE000
trusted library allocation
page read and write
2DF0000
trusted library allocation
page read and write
686E000
stack
page read and write
2D50000
heap
page execute and read and write
F87000
heap
page read and write
1023000
trusted library allocation
page execute and read and write
2BC0000
heap
page execute and read and write
69A0000
heap
page read and write
6B3E000
stack
page read and write
6FC0000
trusted library allocation
page read and write
1070000
trusted library allocation
page read and write
539B000
stack
page read and write
2E09000
trusted library allocation
page read and write
6E7D000
stack
page read and write
5330000
trusted library allocation
page execute and read and write
6FE0000
heap
page read and write
9FA000
stack
page read and write
6A10000
trusted library allocation
page execute and read and write
2BC5000
trusted library allocation
page read and write
2AD3000
trusted library allocation
page execute and read and write
5381000
trusted library allocation
page read and write
103D000
trusted library allocation
page execute and read and write
5540000
trusted library section
page readonly
2B0B000
trusted library allocation
page execute and read and write
2E14000
trusted library allocation
page read and write
6980000
heap
page read and write
45B7000
trusted library allocation
page read and write
52D0000
heap
page read and write
2AF2000
trusted library allocation
page read and write
3D61000
trusted library allocation
page read and write
2D7F000
stack
page read and write
537E000
trusted library allocation
page read and write
2D20000
trusted library allocation
page read and write
5670000
heap
page read and write
5230000
trusted library allocation
page read and write
7572000
trusted library allocation
page read and write
6776000
heap
page read and write
53DC000
stack
page read and write
5490000
heap
page read and write
4605000
trusted library allocation
page read and write
8FEE000
stack
page read and write
2D0D000
trusted library allocation
page read and write
7070000
trusted library allocation
page execute and read and write
72EF000
stack
page read and write
F39000
stack
page read and write
79B5000
heap
page read and write
F80000
heap
page read and write
2E18000
trusted library allocation
page read and write
6EBD000
stack
page read and write
3035000
trusted library allocation
page read and write
7055000
trusted library allocation
page read and write
5480000
heap
page execute and read and write
2BA0000
trusted library allocation
page read and write
63AD000
stack
page read and write
67B2000
heap
page read and write
56A0000
heap
page read and write
52E0000
trusted library allocation
page read and write
1021000
heap
page read and write
536E000
trusted library allocation
page read and write
3D69000
trusted library allocation
page read and write
57CC000
stack
page read and write
2AED000
trusted library allocation
page execute and read and write
2B02000
trusted library allocation
page read and write
7050000
trusted library allocation
page execute and read and write
6E7E000
heap
page read and write
122FE000
stack
page read and write
104A000
trusted library allocation
page execute and read and write
6FD0000
trusted library section
page read and write
5210000
trusted library allocation
page read and write
6970000
trusted library allocation
page read and write
400000
remote allocation
page execute and read and write
5224000
trusted library allocation
page read and write
1090000
heap
page read and write
69C0000
trusted library allocation
page read and write
6D7E000
stack
page read and write
1024000
trusted library allocation
page read and write
2AF6000
trusted library allocation
page execute and read and write
FC6000
heap
page read and write
5310000
trusted library allocation
page read and write
96C000
unkown
page readonly
F90000
heap
page read and write
1020000
trusted library allocation
page read and write
11913000
trusted library allocation
page read and write
3DEA000
trusted library allocation
page read and write
537A000
trusted library allocation
page read and write
101F000
heap
page read and write
6997000
trusted library allocation
page read and write
2CDE000
stack
page read and write
F0E000
stack
page read and write
F10000
heap
page read and write
2AD4000
trusted library allocation
page read and write
796C000
heap
page read and write
2C70000
heap
page read and write
5695000
heap
page read and write
6E70000
heap
page read and write
10A5000
heap
page read and write
6A5E000
stack
page read and write
105F000
heap
page read and write
2D61000
trusted library allocation
page read and write
1350000
heap
page read and write
8EAF000
stack
page read and write
5253000
heap
page read and write
6A0D000
stack
page read and write
7010000
trusted library allocation
page read and write
8DAE000
stack
page read and write
2D6B000
trusted library allocation
page read and write
3DA9000
trusted library allocation
page read and write
6F70000
trusted library section
page read and write
E80000
heap
page read and write
E85000
heap
page read and write
5680000
trusted library allocation
page read and write
2A80000
heap
page read and write
2D70000
trusted library allocation
page read and write
1052000
trusted library allocation
page read and write
536B000
trusted library allocation
page read and write
52E9000
trusted library allocation
page read and write
2B50000
trusted library allocation
page read and write
5366000
trusted library allocation
page read and write
7968000
heap
page read and write
51A0000
heap
page read and write
2BB0000
trusted library allocation
page read and write
43E000
remote allocation
page execute and read and write
2CE0000
trusted library allocation
page read and write
69CD000
trusted library allocation
page read and write
5360000
trusted library allocation
page read and write
7050000
trusted library allocation
page read and write
132C000
stack
page read and write
1057000
trusted library allocation
page execute and read and write
1002000
heap
page read and write
6B50000
trusted library allocation
page read and write
11DE000
stack
page read and write
1042000
trusted library allocation
page read and write
E820000
trusted library section
page read and write
6FF0000
trusted library section
page read and write
6CFF000
stack
page read and write
11AF000
stack
page read and write
2B00000
trusted library allocation
page read and write
6730000
heap
page read and write
2AD0000
trusted library allocation
page read and write
8A0000
unkown
page readonly
1340000
trusted library allocation
page read and write
2BB0000
trusted library allocation
page execute and read and write
6B40000
trusted library allocation
page read and write
12EE000
stack
page read and write
696D000
stack
page read and write
F52000
heap
page read and write
7FB00000
trusted library allocation
page execute and read and write
7000000
heap
page read and write
2B60000
trusted library allocation
page read and write
2D81000
trusted library allocation
page read and write
52E2000
trusted library allocation
page read and write
5340000
trusted library allocation
page read and write
F37000
heap
page read and write
1040000
trusted library allocation
page read and write
6979000
trusted library allocation
page read and write
2B05000
trusted library allocation
page execute and read and write
2AC0000
trusted library allocation
page read and write
102F000
heap
page read and write
6D3E000
stack
page read and write
7001000
trusted library allocation
page read and write
1330000
trusted library allocation
page execute and read and write
1190000
heap
page read and write
102D000
trusted library allocation
page execute and read and write
1046000
trusted library allocation
page execute and read and write
538D000
trusted library allocation
page read and write
5300000
heap
page read and write
FE0000
heap
page read and write
53A0000
heap
page execute and read and write
58B0000
trusted library allocation
page execute and read and write
70EE000
stack
page read and write
2ADD000
trusted library allocation
page execute and read and write
2CE4000
trusted library allocation
page read and write
6AFE000
stack
page read and write
5550000
heap
page read and write
2DE4000
trusted library allocation
page read and write
56B0000
heap
page read and write
8EEE000
stack
page read and write
2D40000
trusted library allocation
page read and write
6FCE000
stack
page read and write
2AFA000
trusted library allocation
page execute and read and write
69B0000
trusted library allocation
page execute and read and write
2B6E000
stack
page read and write
4653000
trusted library allocation
page read and write
E3A000
stack
page read and write
2D7F000
trusted library allocation
page read and write
679C000
heap
page read and write
7992000
heap
page read and write
585E000
stack
page read and write
2D12000
trusted library allocation
page read and write
2AF0000
trusted library allocation
page read and write
5250000
heap
page read and write
1357000
heap
page read and write
10A0000
heap
page read and write
1197000
heap
page read and write
5303000
heap
page read and write
71EE000
stack
page read and write
589E000
stack
page read and write
2BD8000
trusted library allocation
page read and write
F70000
heap
page read and write
7964000
heap
page read and write
1010000
trusted library allocation
page read and write
4E7D000
stack
page read and write
3D81000
trusted library allocation
page read and write
6B47000
trusted library allocation
page read and write
2AE0000
trusted library allocation
page read and write
2B3D000
stack
page read and write
6FE0000
trusted library allocation
page read and write
D60000
heap
page read and write
1050000
trusted library allocation
page read and write
10A0000
heap
page read and write
FBA000
heap
page read and write
F98000
heap
page read and write
FC4000
heap
page read and write
There are 240 hidden memdumps, click here to show them.