IOC Report
Bank Reportr.exe

loading gifFilesProcessesURLsDomainsRegistryMemdumps108642010010Label

Files

File Path
Type
Category
Malicious
Download
Bank Reportr.exe
PE32+ executable (GUI) x86-64, for MS Windows
initial sample
 malicious
C:\Users\user\Bank Reportr.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0tlzjvb2.dwe.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1llfuoud.uu5.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1wjuvfjd.jox.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_drsqo2do.rel.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fuk2pnjb.fjw.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hmh2gryb.its.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i4ub0xrs.hjc.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kg5i2uwi.y1u.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kv2mn5xz.hnt.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pdqlaomj.t52.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tgn2fsc0.uft.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wcnhu1a2.fg2.ps1
ASCII text, with no line terminators
dropped
There are 5 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Bank Reportr.exe
"C:\Users\user\Desktop\Bank Reportr.exe"
 malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
 malicious
C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe"
 malicious
C:\Users\user\Bank Reportr.exe
"C:\Users\user\Bank Reportr.exe"
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
 malicious
C:\Users\user\Bank Reportr.exe
"C:\Users\user\Bank Reportr.exe"
malicious
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath $env:UserProfile
 malicious
C:\Windows\System32\calc.exe
"C:\Windows\System32\calc.exe"
 malicious
C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 7 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
unknown
https://aka.ms/GlobalizationInvariantMode
unknown
https://sectigo.com/CPS0
unknown
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
unknown
https://aka.ms/nativeaot-compatibilityp
unknown
http://ocsp.sectigo.com0
unknown
https://aka.ms/nativeaot-c
unknown
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
unknown
https://aka.ms/nativeaot-compatibility
unknown
https://aka.ms/nativeaot-compatibilityY
unknown
https://aka.ms/nativeaot-compatibilityy
unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
unknown
There are 2 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
171.39.242.20.in-addr.arpa
unknown
 malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Bank Reportr

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
5F40000
unclassified section
page execute and read and write
 malicious
5100000
direct allocation
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
23C7BCC2000
heap
page read and write
20CF30A1000
heap
page read and write
23751A00000
direct allocation
page read and write
277E0CE9000
heap
page read and write
6E34000
unclassified section
page execute and read and write
23C7BCBC000
heap
page read and write
5729000
direct allocation
page execute and read and write
24D8B035000
heap
page read and write
5AF7000
direct allocation
page execute and read and write
24D8B0B0000
heap
page read and write
7FF746471000
unkown
page execute read
27D13CB6000
heap
page read and write
23C7BC36000
heap
page read and write
20CF30C4000
heap
page read and write
7FF746697000
unkown
page readonly
23C7BCC3000
heap
page read and write
20CF30CE000
heap
page read and write
5DA1000
direct allocation
page execute and read and write
2374A8A7000
heap
page read and write
5F3F000
stack
page read and write
2374A87C000
heap
page read and write
23C7BEC9000
heap
page read and write
20CF30C4000
heap
page read and write
7FF74C1B2000
unkown
page read and write
20CF3109000
heap
page read and write
7FF74C090000
unkown
page readonly
550E000
stack
page read and write
24D8B03F000
heap
page read and write
20CF30A4000
heap
page read and write
20CF30C6000
heap
page read and write
277E2804000
heap
page read and write
27D13CC1000
heap
page read and write
277E2731000
heap
page read and write
7FF74C2B7000
unkown
page readonly
277E2735000
heap
page read and write
7FF746592000
unkown
page read and write
B0EC2FE000
stack
page read and write
277E27B2000
heap
page read and write
27D13CB0000
heap
page read and write
24D08B1F000
direct allocation
page read and write
27D13D06000
heap
page read and write
27C9171F000
direct allocation
page read and write
5790000
heap
page read and write
20CFA2EC000
direct allocation
page read and write
598F000
stack
page read and write
23C80E00000
direct allocation
page read and write
20CF310A000
heap
page read and write
24D8B030000
heap
page read and write
5A0E000
stack
page read and write
505C000
stack
page read and write
20CF30BF000
heap
page read and write
23C7BCA0000
heap
page read and write
23C7BCC4000
heap
page read and write
277E27E2000
heap
page read and write
2374A7B0000
heap
page read and write
5BB2000
direct allocation
page execute and read and write
5590000
direct allocation
page read and write
277E27B6000
heap
page read and write
2374A8B7000
heap
page read and write
2375240A000
direct allocation
page read and write
277E27C1000
heap
page read and write
23C7BB90000
heap
page read and write
23C7BBD0000
direct allocation
page read and write
7FF74C2A7000
unkown
page write copy
2374A88B000
heap
page read and write
20CF3109000
heap
page read and write
23C7BC3C000
heap
page read and write
27D13CBF000
heap
page read and write
2374E800000
direct allocation
page read and write
23C7BCAE000
heap
page read and write
23C7BCAE000
heap
page read and write
4C746FE000
stack
page read and write
23C83200000
direct allocation
page read and write
7FF74C2A7000
unkown
page read and write
4C747FF000
stack
page read and write
23751000000
direct allocation
page read and write
23C7BD07000
heap
page read and write
2374A899000
heap
page read and write
5DBD000
direct allocation
page execute and read and write
23C7BE00000
heap
page read and write
2374A8AE000
heap
page read and write
7FF74C2B7000
unkown
page readonly
23C7BEEF000
heap
page read and write
27D13CE2000
heap
page read and write
7FF74C2B7000
unkown
page readonly
20CF311A000
heap
page read and write
58CD000
direct allocation
page execute and read and write
20CF3030000
heap
page read and write
4C744FF000
stack
page read and write
2374A8F2000
heap
page read and write
7FF74C2AF000
unkown
page read and write
20CF30BF000
heap
page read and write
2374EC00000
direct allocation
page read and write
20CF30C9000
heap
page read and write
23C7D800000
direct allocation
page read and write
27D13D04000
heap
page read and write
23C7BCCC000
heap
page read and write
20CF310C000
heap
page read and write
20CFA200000
direct allocation
page read and write
20CF3345000
heap
page read and write
277E2730000
heap
page read and write
277E27B0000
heap
page read and write
277E27BF000
heap
page read and write
5580000
heap
page read and write
2374A89F000
heap
page read and write
23C7BCC8000
heap
page read and write
23C7BCBA000
heap
page read and write
24D8B082000
heap
page read and write
2374A89A000
heap
page read and write
2374A8A5000
heap
page read and write
20CF32ED000
heap
page read and write
20CF310C000
heap
page read and write
27D13CB2000
heap
page read and write
20CF30AF000
heap
page read and write
20CF2FC0000
heap
page read and write
55C0000
heap
page read and write
42F000
remote allocation
page execute and read and write
54C0000
heap
page read and write
20CF30B0000
heap
page read and write
23C80400000
direct allocation
page read and write
27D13C35000
heap
page read and write
B0EB9FE000
stack
page read and write
B0EBDFF000
stack
page read and write
20CF3200000
heap
page read and write
AAE16FE000
stack
page read and write
554A000
direct allocation
page read and write
277E27B0000
heap
page read and write
7FF74C1B2000
unkown
page read and write
7FF74C2A7000
unkown
page read and write
20CF30BF000
heap
page read and write
277E0D0D000
heap
page read and write
27D13CB0000
heap
page read and write
20CF3010000
direct allocation
page read and write
20CF9800000
direct allocation
page read and write
2374A879000
heap
page read and write
20CF3036000
heap
page read and write
31D000
stack
page read and write
277E2731000
heap
page read and write
24D8B031000
heap
page read and write
20CF7400000
direct allocation
page read and write
20CF30B5000
heap
page read and write
7FF74C091000
unkown
page execute read
5A10000
heap
page read and write
2374A810000
direct allocation
page read and write
23C7BCB2000
heap
page read and write
2374A8B4000
heap
page read and write
B0EC1FE000
stack
page read and write
23C7BCC3000
heap
page read and write
AAE19FE000
stack
page read and write
4C745FE000
stack
page read and write
27D13D06000
heap
page read and write
277E2806000
heap
page read and write
AAE11FF000
stack
page read and write
3D0000
heap
page read and write
AAE14FE000
stack
page read and write
27C856FA000
direct allocation
page read and write
5B76000
direct allocation
page execute and read and write
23C82800000
direct allocation
page read and write
23C7F800000
direct allocation
page read and write
23C8380C000
direct allocation
page read and write
20CF2FE0000
heap
page read and write
5300000
heap
page read and write
526F000
stack
page read and write
7FF74C204000
unkown
page readonly
2374AAD5000
heap
page read and write
2374A89F000
heap
page read and write
20CF303C000
heap
page read and write
23C7BBC0000
direct allocation
page read and write
20CF310C000
heap
page read and write
AAE10FF000
stack
page read and write
277E27B0000
heap
page read and write
27D13C45000
heap
page read and write
27D13CB0000
heap
page read and write
2374A8B7000
heap
page read and write
5510000
heap
page read and write
277E27E2000
heap
page read and write
20CF3340000
heap
page read and write
5B70000
direct allocation
page execute and read and write
277E27B6000
heap
page read and write
2374A8AE000
heap
page read and write
23C7BB60000
heap
page read and write
380000
heap
page read and write
AAE12FF000
stack
page read and write
23752400000
direct allocation
page read and write
23C7BCC3000
heap
page read and write
55C7000
heap
page read and write
B0EBEFF000
stack
page read and write
24D8B049000
heap
page read and write
2374A8AD000
heap
page read and write
23C7BCAF000
heap
page read and write
20CF3090000
heap
page read and write
AAE17FD000
stack
page read and write
2374A8AF000
heap
page read and write
23C7BD07000
heap
page read and write
2374C400000
direct allocation
page read and write
7FF74C091000
unkown
page execute read
5600000
direct allocation
page execute and read and write
20CF7E00000
direct allocation
page read and write
B0EBFFE000
stack
page read and write
7FF7465E4000
unkown
page readonly
4C748FE000
stack
page read and write
2374AAD0000
heap
page read and write
20CF3109000
heap
page read and write
AAE18FC000
stack
page read and write
4C73FC7000
stack
page read and write
27D13CB0000
heap
page read and write
7FF74C091000
unkown
page execute read
23C7BB70000
heap
page read and write
20CF4C00000
direct allocation
page read and write
7FF74C090000
unkown
page readonly
27D13CC1000
heap
page read and write
2374A8A5000
heap
page read and write
277E27C1000
heap
page read and write
4C749FD000
stack
page read and write
4C74AFE000
stack
page read and write
20CF2FB0000
heap
page read and write
7FF74C2A7000
unkown
page write copy
27D13CB6000
heap
page read and write
7FF746687000
unkown
page write copy
27D13CB6000
heap
page read and write
20CF30AF000
heap
page read and write
23C7BCC3000
heap
page read and write
7FF74C204000
unkown
page readonly
572D000
direct allocation
page execute and read and write
27D13C30000
heap
page read and write
2374A899000
heap
page read and write
7FF7465E4000
unkown
page readonly
23C80003000
direct allocation
page read and write
5350000
heap
page read and write
7FF74C2B7000
unkown
page readonly
277E27B0000
heap
page read and write
7FF74C090000
unkown
page readonly
20CFAD61000
direct allocation
page read and write
AAE0D47000
stack
page read and write
545A000
stack
page read and write
2374A8C1000
heap
page read and write
20CF30B5000
heap
page read and write
5C13000
direct allocation
page execute and read and write
2374A8AE000
heap
page read and write
48E0000
heap
page read and write
2374A834000
heap
page read and write
277E27B0000
heap
page read and write
5520000
direct allocation
page read and write
20CF310A000
heap
page read and write
27D13CE2000
heap
page read and write
23C7BF45000
heap
page read and write
7FF74C204000
unkown
page readonly
2374A88E000
heap
page read and write
27D13C31000
heap
page read and write
20CF30C4000
heap
page read and write
B0EB8F7000
stack
page read and write
2374A800000
direct allocation
page read and write
2374A8AE000
heap
page read and write
2374A820000
heap
page read and write
23C7BF40000
heap
page read and write
277E27B6000
heap
page read and write
579E000
direct allocation
page execute and read and write
7FF746687000
unkown
page read and write
7FF74C090000
unkown
page readonly
277E2806000
heap
page read and write
7FF746471000
unkown
page execute read
20CF7003000
direct allocation
page read and write
20CF310C000
heap
page read and write
7FF746470000
unkown
page readonly
20CF30CE000
heap
page read and write
23C7BCB4000
heap
page read and write
2374F600000
direct allocation
page read and write
B0EC3FC000
stack
page read and write
2374E803000
direct allocation
page read and write
277E27E2000
heap
page read and write
5948000
direct allocation
page execute and read and write
7FF74668F000
unkown
page read and write
5C19000
direct allocation
page execute and read and write
5AF0000
direct allocation
page execute and read and write
23C7BC30000
heap
page read and write
24D8B082000
heap
page read and write
27D13CB0000
heap
page read and write
277E0C20000
heap
page read and write
2374A8F2000
heap
page read and write
50FF000
stack
page read and write
8234000
unclassified section
page execute and read and write
B0EC0FD000
stack
page read and write
20CF3092000
heap
page read and write
20CF32C9000
heap
page read and write
4C743FF000
stack
page read and write
277E2749000
heap
page read and write
7FF746697000
unkown
page readonly
4C74BFC000
stack
page read and write
5A35000
direct allocation
page execute and read and write
24D8B0A5000
heap
page read and write
2374A89F000
heap
page read and write
27D13D04000
heap
page read and write
58B1000
direct allocation
page execute and read and write
AAE15FF000
stack
page read and write
2374A890000
heap
page read and write
5B16000
direct allocation
page execute and read and write
23C7BCAE000
heap
page read and write
20CF7000000
direct allocation
page read and write
2374A88B000
heap
page read and write
27D13C31000
heap
page read and write
3CE000
stack
page read and write
23C7BC8E000
heap
page read and write
24D8B045000
heap
page read and write
7FF74C2AF000
unkown
page read and write
27D13C49000
heap
page read and write
20CF30C2000
heap
page read and write
20CF30C4000
heap
page read and write
2374A828000
heap
page read and write
7FF746470000
unkown
page readonly
277E27E2000
heap
page read and write
27D13C32000
heap
page read and write
4C742FE000
stack
page read and write
B0EBBFF000
stack
page read and write
277E2745000
heap
page read and write
2374A89E000
heap
page read and write
20CFA361000
direct allocation
page read and write
55E000
stack
page read and write
20CF30A1000
heap
page read and write
4FFD000
stack
page read and write
B0EBAFE000
stack
page read and write
27D13CE2000
heap
page read and write
277540FA000
direct allocation
page read and write
7834000
unclassified section
page execute and read and write
5160000
heap
page read and write
23C7BCBA000
heap
page read and write
7FF74C091000
unkown
page execute read
5DB6000
direct allocation
page execute and read and write
2374A6D0000
heap
page read and write
23C7BC9F000
heap
page read and write
20CF30CE000
heap
page read and write
277E2804000
heap
page read and write
7FF74C204000
unkown
page readonly
58C6000
direct allocation
page execute and read and write
20CF30B9000
heap
page read and write
6434000
unclassified section
page execute and read and write
2374A8AE000
heap
page read and write
23C7BCC3000
heap
page read and write
277E2732000
heap
page read and write
400000
remote allocation
page execute and read and write
27D13CE2000
heap
page read and write
20CF30C9000
heap
page read and write
20CF30C9000
heap
page read and write
24D8B0B0000
heap
page read and write
20CF30C4000
heap
page read and write
2374A8AE000
heap
page read and write
24CFCAFA000
direct allocation
page read and write
2374A7D0000
heap
page read and write
B0EBCFE000
stack
page read and write
20CF3020000
direct allocation
page read and write
5358000
heap
page read and write
AAE13FE000
stack
page read and write
2776011F000
direct allocation
page read and write
20CF30B7000
heap
page read and write
20CF3109000
heap
page read and write
2374A8A5000
heap
page read and write
There are 348 hidden memdumps, click here to show them.