IOC Report
Justificante de pago.exe

loading gif

Files

File Path
Type
Category
Malicious
Justificante de pago.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\remcos\logs.dat
data
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Justificante de pago.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmpEABB.tmp
XML 1.0 document, ASCII text
dropped
 malicious
C:\Users\user\AppData\Roaming\TYLngHLuy.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\TYLngHLuy.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TYLngHLuy.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
modified
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_001zlfkd.rgi.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_02xwf3ce.ved.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_15l3famr.dce.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dmhs2hgq.lzt.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ezzjak4j.ypw.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_geop2jay.okb.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_puf0bld0.v30.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xovyzgp2.fzb.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp529.tmp
XML 1.0 document, ASCII text
dropped
There are 7 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Justificante de pago.exe
"C:\Users\user\Desktop\Justificante de pago.exe"
 malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Justificante de pago.exe"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TYLngHLuy.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TYLngHLuy" /XML "C:\Users\user\AppData\Local\Temp\tmpEABB.tmp"
 malicious
C:\Users\user\Desktop\Justificante de pago.exe
"C:\Users\user\Desktop\Justificante de pago.exe"
 malicious
C:\Users\user\AppData\Roaming\TYLngHLuy.exe
C:\Users\user\AppData\Roaming\TYLngHLuy.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TYLngHLuy" /XML "C:\Users\user\AppData\Local\Temp\tmp529.tmp"
 malicious
C:\Users\user\AppData\Roaming\TYLngHLuy.exe
"C:\Users\user\AppData\Roaming\TYLngHLuy.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 3 hidden processes, click here to show them.

URLs

Name
IP
Malicious
1
malicious
http://geoplugin.net/json.gp
unknown
http://localhost/arkanoid_server/requests.php
unknown
http://geoplugin.net/json.gp/C
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown

IPs

IP
Domain
Country
Malicious
127.0.0.1
unknown
unknown

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Rmc-14OQCD
exepath
HKEY_CURRENT_USER\SOFTWARE\Rmc-14OQCD
licence
HKEY_CURRENT_USER\SOFTWARE\Rmc-14OQCD
time

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
remote allocation
page execute and read and write
 malicious
D57000
heap
page read and write
 malicious
13EB000
heap
page read and write
 malicious
3B52000
trusted library allocation
page read and write
 malicious
2E6F000
stack
page read and write
 malicious
4F93000
trusted library allocation
page read and write
 malicious
1650000
heap
page read and write
1410000
trusted library allocation
page read and write
7F070000
trusted library allocation
page execute and read and write
8160000
heap
page read and write
DA80000
trusted library allocation
page execute and read and write
C79000
heap
page read and write
14A5000
heap
page read and write
29D0000
trusted library allocation
page read and write
79F0000
trusted library allocation
page read and write
74C6000
trusted library allocation
page read and write
79BE000
stack
page read and write
64EE000
stack
page read and write
662E000
stack
page read and write
6F1E000
stack
page read and write
D80000
unkown
page readonly
2A3F000
unkown
page read and write
B5B0000
trusted library allocation
page read and write
2F40000
heap
page read and write
7BC0000
trusted library allocation
page read and write
CBE000
stack
page read and write
8292000
heap
page read and write
8140000
trusted library allocation
page read and write
29E0000
heap
page read and write
ECC000
stack
page read and write
7FC000
stack
page read and write
7FBE000
stack
page read and write
F0A000
stack
page read and write
DA7E000
stack
page read and write
7A00000
heap
page read and write
1470000
trusted library allocation
page read and write
4A75000
trusted library allocation
page read and write
4271000
trusted library allocation
page read and write
1950000
trusted library allocation
page read and write
15EE000
stack
page read and write
68BE000
stack
page read and write
E3BE000
stack
page read and write
8050000
trusted library section
page readonly
4331000
trusted library allocation
page read and write
74AB000
trusted library allocation
page read and write
7860000
trusted library allocation
page execute and read and write
2E2E000
stack
page read and write
9DCE000
stack
page read and write
701E000
stack
page read and write
1442000
trusted library allocation
page read and write
899000
stack
page read and write
4AF0000
trusted library allocation
page read and write
2F85000
trusted library allocation
page read and write
8922000
heap
page read and write
1446000
trusted library allocation
page execute and read and write
79E0000
trusted library allocation
page read and write
A06E000
stack
page read and write
6C9C000
stack
page read and write
E17E000
stack
page read and write
15CF000
stack
page read and write
8280000
heap
page read and write
1630000
trusted library allocation
page read and write
9F70000
trusted library section
page read and write
1423000
trusted library allocation
page execute and read and write
1969000
heap
page read and write
C00000
heap
page read and write
782B000
stack
page read and write
69BE000
stack
page read and write
818F000
heap
page read and write
3200000
trusted library allocation
page read and write
1424000
trusted library allocation
page read and write
7E30000
trusted library allocation
page execute and read and write
AE10000
trusted library allocation
page read and write
102B000
trusted library allocation
page execute and read and write
101A000
trusted library allocation
page execute and read and write
29C0000
trusted library allocation
page read and write
3704000
trusted library allocation
page read and write
5110000
heap
page read and write
813A000
trusted library allocation
page read and write
8030000
trusted library allocation
page read and write
47B6000
trusted library allocation
page read and write
2940000
trusted library allocation
page execute and read and write
1000000
trusted library allocation
page read and write
1440000
trusted library allocation
page read and write
13D7000
heap
page read and write
29B0000
trusted library allocation
page read and write
C10000
heap
page read and write
57CE000
trusted library allocation
page read and write
95D0000
trusted library allocation
page read and write
FE0000
trusted library allocation
page read and write
57AE000
stack
page read and write
57D6000
trusted library allocation
page read and write
4B3E000
stack
page read and write
4311000
trusted library allocation
page read and write
FFD000
trusted library allocation
page execute and read and write
29F9000
stack
page read and write
1960000
heap
page read and write
7875000
heap
page read and write
FBE000
stack
page read and write
2F2D000
stack
page read and write
890E000
stack
page read and write
9400000
heap
page read and write
473000
remote allocation
page execute and read and write
476000
remote allocation
page execute and read and write
57B0000
trusted library allocation
page read and write
8145000
heap
page read and write
100D000
trusted library allocation
page execute and read and write
8195000
heap
page read and write
8130000
trusted library allocation
page read and write
8060000
trusted library allocation
page execute and read and write
1450000
trusted library allocation
page read and write
43FA000
trusted library allocation
page read and write
28C0000
heap
page read and write
8020000
trusted library allocation
page read and write
3260000
heap
page read and write
CDE000
heap
page read and write
74D0000
trusted library allocation
page read and write
31C0000
heap
page read and write
8910000
heap
page read and write
8733000
heap
page read and write
9A90000
heap
page read and write
9CCE000
stack
page read and write
31AD000
stack
page read and write
2C60000
heap
page read and write
6770000
heap
page read and write
2960000
heap
page execute and read and write
7F7C0000
trusted library allocation
page execute and read and write
DE7D000
stack
page read and write
162C000
stack
page read and write
3271000
trusted library allocation
page read and write
FCC000
stack
page read and write
2EEC000
stack
page read and write
771A000
trusted library allocation
page read and write
7C4B000
stack
page read and write
194F000
stack
page read and write
FC0000
heap
page read and write
3205000
trusted library allocation
page read and write
42F9000
trusted library allocation
page read and write
63EF000
stack
page read and write
D12000
heap
page read and write
95CB000
trusted library allocation
page read and write
1027000
trusted library allocation
page execute and read and write
4AB1000
trusted library allocation
page read and write
FCE000
stack
page read and write
8000000
trusted library section
page read and write
D51000
heap
page read and write
1010000
trusted library allocation
page read and write
9C8E000
stack
page read and write
7BF0000
heap
page read and write
13D0000
heap
page read and write
144A000
trusted library allocation
page execute and read and write
142D000
trusted library allocation
page execute and read and write
290E000
unkown
page read and write
1696000
heap
page read and write
7FFE000
stack
page read and write
57B4000
trusted library allocation
page read and write
8075000
heap
page read and write
7510000
trusted library allocation
page read and write
2D80000
heap
page read and write
A192000
trusted library allocation
page read and write
894D000
heap
page read and write
7720000
trusted library allocation
page read and write
8155000
trusted library allocation
page read and write
29BD000
stack
page read and write
1677000
heap
page read and write
5113000
heap
page read and write
29C4000
trusted library allocation
page read and write
165E000
heap
page read and write
997000
stack
page read and write
12F7000
stack
page read and write
7550000
heap
page read and write
74E5000
trusted library allocation
page read and write
7E10000
heap
page read and write
324F000
stack
page read and write
57D1000
trusted library allocation
page read and write
CD0000
heap
page read and write
1040000
trusted library allocation
page read and write
C40000
heap
page read and write
29AB000
stack
page read and write
7BB0000
trusted library allocation
page execute and read and write
13BD000
stack
page read and write
FF0000
trusted library allocation
page read and write
1430000
trusted library allocation
page read and write
7BCA000
trusted library allocation
page read and write
8150000
trusted library allocation
page read and write
145B000
trusted library allocation
page execute and read and write
F70000
heap
page read and write
1016000
trusted library allocation
page execute and read and write
140E000
stack
page read and write
D00000
heap
page read and write
FF3000
trusted library allocation
page execute and read and write
B60000
heap
page read and write
69FD000
stack
page read and write
8187000
heap
page read and write
74F0000
trusted library allocation
page read and write
6AFE000
stack
page read and write
6D9C000
stack
page read and write
2ABF000
stack
page read and write
463D000
trusted library allocation
page read and write
652E000
stack
page read and write
9A00000
trusted library allocation
page execute and read and write
7BC2000
trusted library allocation
page read and write
1709000
heap
page read and write
CAE000
stack
page read and write
3210000
trusted library allocation
page read and write
339B000
trusted library allocation
page read and write
FF4000
trusted library allocation
page read and write
124F000
stack
page read and write
74A0000
trusted library allocation
page read and write
AFC000
stack
page read and write
1050000
heap
page read and write
2F75000
trusted library allocation
page read and write
D98000
heap
page read and write
29C6000
trusted library allocation
page read and write
1240000
heap
page read and write
6DDE000
stack
page read and write
1420000
trusted library allocation
page read and write
2950000
trusted library allocation
page read and write
3AF1000
trusted library allocation
page read and write
2EAC000
stack
page read and write
95C0000
trusted library allocation
page read and write
7560000
heap
page read and write
473000
remote allocation
page execute and read and write
31EE000
stack
page read and write
2F10000
heap
page read and write
666D000
stack
page read and write
940F000
heap
page read and write
7DF0000
heap
page read and write
5810000
heap
page read and write
C70000
heap
page read and write
DD3E000
stack
page read and write
D04000
heap
page read and write
2AD0000
heap
page read and write
D82000
unkown
page readonly
4C8D000
stack
page read and write
1640000
trusted library allocation
page read and write
42F5000
trusted library allocation
page read and write
8100000
heap
page read and write
7760000
heap
page read and write
2F1B000
heap
page read and write
8765000
heap
page read and write
8763000
heap
page read and write
797D000
stack
page read and write
DA3E000
stack
page read and write
74C1000
trusted library allocation
page read and write
2DEF000
unkown
page read and write
D50000
heap
page read and write
DF7D000
stack
page read and write
DE0000
heap
page read and write
DE3E000
stack
page read and write
7A40000
trusted library section
page readonly
7750000
trusted library allocation
page read and write
F80000
heap
page read and write
4B7E000
stack
page read and write
8119000
heap
page read and write
16DA000
heap
page read and write
470000
remote allocation
page execute and read and write
2AEF000
stack
page read and write
8710000
heap
page read and write
1020000
trusted library allocation
page read and write
500E000
stack
page read and write
7870000
heap
page read and write
31F0000
trusted library allocation
page read and write
1457000
trusted library allocation
page execute and read and write
1490000
trusted library allocation
page execute and read and write
6EDE000
stack
page read and write
2A7E000
stack
page read and write
293E000
stack
page read and write
7E40000
heap
page execute and read and write
87A1000
heap
page read and write
2920000
heap
page read and write
DF80000
heap
page read and write
1707000
heap
page read and write
14A0000
heap
page read and write
CDA000
heap
page read and write
1360000
heap
page read and write
8070000
heap
page read and write
2E6F000
stack
page read and write
2BCC000
trusted library allocation
page read and write
E27C000
stack
page read and write
135E000
stack
page read and write
C5E000
stack
page read and write
74D2000
trusted library allocation
page read and write
115E000
stack
page read and write
74A4000
trusted library allocation
page read and write
5823000
heap
page read and write
1694000
heap
page read and write
4F56000
trusted library allocation
page read and write
1685000
heap
page read and write
7DE0000
trusted library allocation
page read and write
143D000
trusted library allocation
page execute and read and write
3240000
trusted library allocation
page read and write
7712000
trusted library allocation
page read and write
3B15000
trusted library allocation
page read and write
80FE000
stack
page read and write
1480000
heap
page read and write
287A000
stack
page read and write
1230000
heap
page read and write
2ADA000
heap
page read and write
7030000
trusted library allocation
page execute and read and write
4A79000
trusted library allocation
page read and write
2910000
heap
page read and write
46FA000
trusted library allocation
page read and write
9F6C000
stack
page read and write
2AF1000
trusted library allocation
page read and write
74E0000
trusted library allocation
page read and write
314E000
stack
page read and write
57E2000
trusted library allocation
page read and write
44C2000
trusted library allocation
page read and write
C60000
heap
page read and write
2DA0000
heap
page read and write
3220000
heap
page execute and read and write
184E000
stack
page read and write
314F000
stack
page read and write
328E000
stack
page read and write
CEE000
stack
page read and write
CEF000
heap
page read and write
4580000
trusted library allocation
page read and write
815E000
heap
page read and write
1022000
trusted library allocation
page read and write
74CD000
trusted library allocation
page read and write
2D7E000
unkown
page read and write
5820000
heap
page read and write
338F000
stack
page read and write
74BE000
trusted library allocation
page read and write
7570000
trusted library allocation
page execute and read and write
D54000
heap
page read and write
283D000
stack
page read and write
172B000
heap
page read and write
DC3E000
stack
page read and write
57DD000
trusted library allocation
page read and write
7BD0000
trusted library allocation
page read and write
304F000
stack
page read and write
1452000
trusted library allocation
page read and write
8040000
heap
page read and write
D10000
heap
page read and write
7770000
heap
page execute and read and write
E2BD000
stack
page read and write
F4F000
stack
page read and write
510E000
stack
page read and write
536D000
stack
page read and write
57BB000
trusted library allocation
page read and write
7710000
trusted library allocation
page read and write
DE5000
heap
page read and write
15AE000
stack
page read and write
1012000
trusted library allocation
page read and write
676D000
stack
page read and write
2DB0000
heap
page read and write
There are 338 hidden memdumps, click here to show them.