IOC Report
Payment_Advice.exe

loading gifFilesProcessesURLsRegistryMemdumps642010010Label

Files

File Path
Type
Category
Malicious
Download
Payment_Advice.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\undiscernibleness\cacostomia.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cacostomia.vbs
data
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_bad_module_info_dcd3242e9fa4189184df4216daa4e4c7cdf1959_85207d7d_9f99cd3b-4c47-490b-babc-c6eb1d6323c6\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER77D0.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER7800.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\WER6810.tmp.WERDataCollectionStatus.txt
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\aut2EA0.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut3324.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\aut60BC.tmp
data
dropped
C:\Users\user\AppData\Local\Temp\incalculable
data
dropped
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Payment_Advice.exe
"C:\Users\user\Desktop\Payment_Advice.exe"
 malicious
C:\Users\user\AppData\Local\undiscernibleness\cacostomia.exe
"C:\Users\user\Desktop\Payment_Advice.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\Desktop\Payment_Advice.exe"
 malicious
C:\Windows\System32\wscript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cacostomia.vbs"
malicious
C:\Users\user\AppData\Local\undiscernibleness\cacostomia.exe
"C:\Users\user\AppData\Local\undiscernibleness\cacostomia.exe"
malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
"C:\Users\user\AppData\Local\undiscernibleness\cacostomia.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 7672 -s 12

URLs

Name
IP
Malicious
185.172.128.70:3808
malicious
http://www.apache.org/licenses/LICENSE-2.0
unknown
http://www.fontbureau.com
unknown
http://www.fontbureau.com/designersG
unknown
https://api.ip.sb/ip
unknown
http://www.fontbureau.com/designers/?
unknown
http://www.founder.com.cn/cn/bThe
unknown
http://www.fontbureau.com/designers?
unknown
http://www.tiro.com
unknown
https://api.ip.s
unknown
http://www.fontbureau.com/designers
unknown
http://www.carterandcone.coml
unknown
http://www.sajatypeworks.com
unknown
http://www.typography.netD
unknown
http://www.fontbureau.com/designers/cabarga.htmlN
unknown
http://www.founder.com.cn/cn/cThe
unknown
http://www.galapagosdesign.com/staff/dennis.htm
unknown
http://www.founder.com.cn/cn
unknown
http://www.fontbureau.com/designers/frere-user.html
unknown
http://www.jiyu-kobo.co.jp/
unknown
https://discord.com/api/v9/users/
unknown
http://www.galapagosdesign.com/DPlease
unknown
http://www.fontbureau.com/designers8
unknown
http://www.fonts.com
unknown
http://www.urwpp.deDPlease
unknown
http://www.zhongyicts.com.cn
unknown
http://www.sakkal.com
unknown
There are 17 hidden URLs, click here to show them.

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
00184012D1FD5612
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId

Memdumps

Base Address
Regiontype
Protect
Malicious
Download
2C11000
trusted library allocation
page read and write
 malicious
CEB000
heap
page read and write
D4A000
heap
page read and write
B30000
unkown
page readonly
F40C2FE000
stack
page read and write
CF6000
heap
page read and write
2DE2000
trusted library allocation
page read and write
24FE000
stack
page read and write
FF0000
heap
page read and write
D1C000
heap
page read and write
F8A000
heap
page read and write
39CD000
direct allocation
page read and write
CC1000
heap
page read and write
2584C9BE000
heap
page read and write
BE4000
unkown
page readonly
4D0C000
stack
page read and write
2DFD000
trusted library allocation
page read and write
8F5E000
stack
page read and write
D1C000
heap
page read and write
FFF000
heap
page read and write
D4D000
heap
page read and write
2D59000
trusted library allocation
page read and write
2D85000
trusted library allocation
page read and write
F10000
trusted library allocation
page read and write
1094000
unkown
page readonly
110000
heap
page read and write
CF6000
heap
page execute and read and write
9C7000
stack
page read and write
FE0000
heap
page read and write
109E000
unkown
page read and write
5410000
trusted library section
page readonly
371E000
direct allocation
page read and write
2584C6F0000
heap
page read and write
2DCD000
trusted library allocation
page read and write
5123000
heap
page read and write
CF7000
heap
page read and write
5420000
heap
page read and write
F8F000
heap
page read and write
D25000
heap
page read and write
7FD000
stack
page read and write
26D0000
heap
page read and write
2D76000
trusted library allocation
page read and write
F20000
heap
page read and write
199C000
heap
page read and write
5444000
trusted library allocation
page read and write
371E000
direct allocation
page read and write
371E000
direct allocation
page read and write
3580000
direct allocation
page read and write
E2E000
heap
page read and write
D5B000
heap
page read and write
364B000
direct allocation
page read and write
CF7000
heap
page read and write
B30000
unkown
page readonly
E00000
trusted library allocation
page read and write
D60000
heap
page read and write
D65000
heap
page read and write
33E0000
direct allocation
page read and write
2584C7F0000
heap
page read and write
2BD1000
trusted library allocation
page read and write
2584E240000
heap
page read and write
39C9000
direct allocation
page read and write
1094000
unkown
page readonly
2D61000
trusted library allocation
page read and write
19BE000
heap
page read and write
F4B000
heap
page read and write
199C000
heap
page read and write
8E5E000
stack
page read and write
F58000
heap
page read and write
1580000
heap
page read and write
E32000
trusted library allocation
page read and write
50E0000
trusted library allocation
page execute and read and write
D4A000
heap
page read and write
D1A000
heap
page read and write
FCE000
heap
page read and write
CB3000
heap
page read and write
1977000
heap
page read and write
3580000
direct allocation
page read and write
9CE000
stack
page read and write
555D000
stack
page read and write
F9C000
heap
page read and write
D8A000
heap
page read and write
1A0000
heap
page read and write
F28000
heap
page read and write
36AD000
direct allocation
page read and write
B30000
unkown
page readonly
38A0000
direct allocation
page read and write
373D000
direct allocation
page read and write
37AE000
direct allocation
page read and write
BEE000
unkown
page read and write
195F000
heap
page read and write
82C000
system
page execute and read and write
FBF000
heap
page read and write
D4C000
heap
page read and write
2D80000
trusted library allocation
page read and write
2D97000
trusted library allocation
page read and write
199C000
heap
page read and write
373D000
direct allocation
page read and write
183D000
stack
page read and write
3610000
direct allocation
page read and write
3593000
direct allocation
page read and write
39C9000
direct allocation
page read and write
3503000
direct allocation
page read and write
CF6000
heap
page read and write
3580000
direct allocation
page read and write
D3B000
heap
page read and write
3580000
direct allocation
page read and write
D0D000
heap
page read and write
19E000
stack
page read and write
3580000
direct allocation
page read and write
2DD3000
trusted library allocation
page read and write
400000
system
page execute and read and write
BE4000
unkown
page readonly
39C9000
direct allocation
page read and write
D1A000
heap
page read and write
792E000
stack
page read and write
8CDE000
stack
page read and write
2584C820000
heap
page read and write
FC4000
heap
page read and write
3470000
direct allocation
page read and write
199F000
heap
page read and write
D25000
heap
page read and write
3670000
direct allocation
page read and write
5430000
heap
page read and write
371E000
direct allocation
page read and write
A9000
stack
page read and write
199C000
heap
page read and write
2D91000
trusted library allocation
page read and write
D1A000
heap
page read and write
3700000
direct allocation
page read and write
2DCB000
trusted library allocation
page read and write
D1A000
heap
page read and write
10A7000
unkown
page readonly
17FC000
stack
page read and write
1AB2000
heap
page read and write
C30000
heap
page read and write
CC7000
heap
page execute and read and write
393D000
direct allocation
page read and write
2D5D000
trusted library allocation
page read and write
33E0000
direct allocation
page read and write
2CB7000
trusted library allocation
page read and write
402000
system
page execute and read and write
2BDD000
trusted library allocation
page read and write
2C7A000
trusted library allocation
page read and write
CCE000
heap
page read and write
1B0000
heap
page read and write
1524000
heap
page read and write
CF6000
heap
page read and write
2D7A000
trusted library allocation
page read and write
1977000
heap
page read and write
BEE000
unkown
page write copy
3810000
direct allocation
page read and write
D4E000
stack
page read and write
D3D000
heap
page read and write
5354000
heap
page read and write
6D10000
trusted library allocation
page read and write
50C0000
heap
page read and write
199E000
heap
page read and write
2690000
heap
page read and write
CF6000
heap
page read and write
F40BEFF000
stack
page read and write
C88000
heap
page read and write
3C0000
heap
page read and write
5690000
trusted library allocation
page read and write
CDD000
heap
page read and write
3939000
direct allocation
page read and write
14E0000
heap
page read and write
2E03000
trusted library allocation
page read and write
3823000
direct allocation
page read and write
4200000
direct allocation
page read and write
E57000
trusted library allocation
page execute and read and write
194F000
heap
page read and write
2DEC000
trusted library allocation
page read and write
49C000
stack
page read and write
CE2000
heap
page read and write
DB4000
heap
page read and write
3503000
direct allocation
page read and write
1977000
heap
page read and write
531A000
heap
page read and write
2DEA000
trusted library allocation
page read and write
2D3B000
trusted library allocation
page read and write
FAE000
stack
page read and write
2DEE000
trusted library allocation
page read and write
5596000
heap
page read and write
FF4000
heap
page read and write
3593000
direct allocation
page read and write
33E0000
direct allocation
page read and write
2D9B000
trusted library allocation
page read and write
2E01000
trusted library allocation
page read and write
2DD1000
trusted library allocation
page read and write
3350000
direct allocation
page read and write
1977000
heap
page read and write
194A000
heap
page read and write
711E000
heap
page read and write
D3C000
heap
page read and write
2CED000
trusted library allocation
page read and write
3470000
direct allocation
page read and write
D1A000
heap
page read and write
FE1000
unkown
page execute read
199C000
heap
page read and write
42E000
system
page execute and read and write
195A000
heap
page read and write
19DE000
heap
page read and write
2CBB000
trusted library allocation
page read and write
17CE000
stack
page read and write
E36000
trusted library allocation
page execute and read and write
2DE4000
trusted library allocation
page read and write
2D63000
trusted library allocation
page read and write
1900000
heap
page read and write
D25000
heap
page read and write
3823000
direct allocation
page read and write
9DB000
stack
page read and write
D50000
heap
page read and write
3939000
direct allocation
page read and write
2D7E000
trusted library allocation
page read and write
2DC3000
trusted library allocation
page read and write
CF6000
heap
page read and write
CB0000
heap
page read and write
2584C9B0000
heap
page read and write
E14000
trusted library allocation
page read and write
39AE000
direct allocation
page read and write
3610000
direct allocation
page read and write
F40000
heap
page read and write
36AD000
direct allocation
page read and write
3793000
direct allocation
page read and write
E3A000
trusted library allocation
page execute and read and write
2D93000
trusted library allocation
page read and write
35E0000
direct allocation
page read and write
36A9000
direct allocation
page read and write
2D82000
trusted library allocation
page read and write
4170000
direct allocation
page read and write
DC0000
heap
page read and write
F92000
heap
page read and write
BBF000
unkown
page readonly
DAE000
stack
page read and write
2D65000
trusted library allocation
page read and write
147F000
stack
page read and write
2584C855000
heap
page read and write
3000000
heap
page read and write
1942000
heap
page read and write
2BB0000
trusted library allocation
page read and write
1990000
heap
page read and write
2E05000
trusted library allocation
page read and write
2DB6000
trusted library allocation
page read and write
FE0000
unkown
page readonly
FAB000
heap
page read and write
3C15000
trusted library allocation
page read and write
36AD000
direct allocation
page read and write
BBF000
unkown
page readonly
FF8000
heap
page read and write
3670000
direct allocation
page read and write
1936000
heap
page read and write
DE4000
heap
page read and write
3E20000
heap
page read and write
CF6000
heap
page read and write
42B3000
direct allocation
page read and write
782D000
stack
page read and write
F40BCFF000
stack
page read and write
312F000
stack
page read and write
36A9000
direct allocation
page read and write
E52000
trusted library allocation
page read and write
1949000
heap
page execute and read and write
EF0000
trusted library allocation
page read and write
7110000
heap
page read and write
B10000
heap
page read and write
106F000
unkown
page readonly
1908000
heap
page read and write
18AF000
stack
page read and write
3810000
direct allocation
page read and write
FE6000
heap
page read and write
195E000
heap
page read and write
371E000
direct allocation
page read and write
3939000
direct allocation
page read and write
CC8000
heap
page read and write
3739000
direct allocation
page read and write
38A0000
direct allocation
page read and write
42C1000
direct allocation
page read and write
6D32000
trusted library allocation
page read and write
50D0000
trusted library allocation
page read and write
7DB000
stack
page read and write
BEE000
unkown
page read and write
BF7000
unkown
page readonly
13F7000
heap
page read and write
36AD000
direct allocation
page read and write
3793000
direct allocation
page read and write
2DC7000
trusted library allocation
page read and write
CF0000
heap
page read and write
E70000
trusted library allocation
page read and write
7EF000
stack
page read and write
2E4C000
trusted library allocation
page read and write
E13000
trusted library allocation
page execute and read and write
2D5F000
trusted library allocation
page read and write
E0F000
heap
page read and write
F40BBFE000
stack
page read and write
B0E000
stack
page read and write
2D95000
trusted library allocation
page read and write
D07000
heap
page read and write
5560000
trusted library allocation
page execute and read and write
2DB2000
trusted library allocation
page read and write
2E47000
trusted library allocation
page read and write
F1F000
trusted library allocation
page read and write
9FC000
stack
page read and write
3503000
direct allocation
page read and write
121F000
stack
page read and write
CB8000
heap
page read and write
14BE000
stack
page read and write
35A000
stack
page read and write
ED0000
trusted library allocation
page read and write
13EC000
stack
page read and write
D25000
heap
page read and write
199C000
heap
page read and write
5570000
heap
page read and write
2DB4000
trusted library allocation
page read and write
3593000
direct allocation
page read and write
1500000
direct allocation
page read and write
BBF000
unkown
page readonly
D3B000
heap
page read and write
18E0000
heap
page read and write
37AE000
direct allocation
page read and write
2D99000
trusted library allocation
page read and write
199C000
heap
page read and write
5440000
trusted library allocation
page read and write
1A93000
heap
page read and write
3670000
direct allocation
page read and write
EBE000
stack
page read and write
BE4000
unkown
page readonly
CFE000
heap
page read and write
532A000
heap
page read and write
8D1E000
stack
page read and write
7BE000
stack
page read and write
E1D000
trusted library allocation
page execute and read and write
E5B000
trusted library allocation
page execute and read and write
14AD000
stack
page read and write
5080000
trusted library allocation
page read and write
1520000
heap
page read and write
D4A000
heap
page read and write
CB2000
heap
page read and write
193E000
heap
page read and write
2BB4000
trusted library allocation
page read and write
D6A000
heap
page read and write
F40BAFA000
stack
page read and write
37AE000
direct allocation
page read and write
D6B000
heap
page read and write
BF2000
unkown
page write copy
36A9000
direct allocation
page read and write
13F0000
heap
page read and write
17DB000
stack
page read and write
5450000
heap
page read and write
1941000
heap
page execute and read and write
E30000
trusted library allocation
page read and write
36AD000
direct allocation
page read and write
CBA000
heap
page read and write
111E000
stack
page read and write
D1A000
heap
page read and write
3793000
direct allocation
page read and write
D1D000
heap
page read and write
5322000
heap
page read and write
B31000
unkown
page execute read
5300000
heap
page execute and read and write
2CE6000
trusted library allocation
page read and write
F40C5FB000
stack
page read and write
EC0000
trusted library allocation
page execute and read and write
EDA000
stack
page read and write
5090000
trusted library allocation
page execute and read and write
CC0000
heap
page execute and read and write
BF2000
unkown
page write copy
2BCE000
trusted library allocation
page read and write
D25000
heap
page read and write
2E07000
trusted library allocation
page read and write
1977000
heap
page read and write
5100000
trusted library allocation
page read and write
2DFF000
trusted library allocation
page read and write
3503000
direct allocation
page read and write
3004000
heap
page read and write
38A0000
direct allocation
page read and write
BF7000
unkown
page readonly
1977000
heap
page read and write
CC1000
heap
page read and write
FE1000
unkown
page execute read
F50000
heap
page read and write
1A38000
heap
page read and write
199E000
heap
page read and write
2D55000
trusted library allocation
page read and write
E10000
trusted library allocation
page read and write
2BD6000
trusted library allocation
page read and write
3739000
direct allocation
page read and write
F40C3FE000
stack
page read and write
3E24000
heap
page read and write
F65000
heap
page read and write
F40C4FE000
stack
page read and write
BEE000
unkown
page write copy
2D8F000
trusted library allocation
page read and write
F00000
trusted library allocation
page read and write
39AE000
direct allocation
page read and write
106F000
unkown
page readonly
36A9000
direct allocation
page read and write
FE0000
unkown
page readonly
CEF000
heap
page execute and read and write
15D000
stack
page read and write
B30000
unkown
page readonly
CD8000
heap
page read and write
2DC9000
trusted library allocation
page read and write
BF7000
unkown
page readonly
3503000
direct allocation
page read and write
2B0F000
stack
page read and write
1935000
heap
page read and write
BE4000
unkown
page readonly
33E0000
direct allocation
page read and write
3470000
direct allocation
page read and write
1942000
heap
page read and write
9BE000
stack
page read and write
10A2000
unkown
page write copy
55C7000
heap
page read and write
39AE000
direct allocation
page read and write
3739000
direct allocation
page read and write
2C00000
heap
page read and write
BBF000
unkown
page readonly
E2D000
trusted library allocation
page execute and read and write
2DA2000
trusted library allocation
page read and write
393D000
direct allocation
page read and write
393D000
direct allocation
page read and write
3E0000
heap
page read and write
5310000
heap
page read and write
2DF0000
trusted library allocation
page read and write
1977000
heap
page read and write
A60000
heap
page read and write
D5C000
heap
page read and write
B31000
unkown
page execute read
5050000
trusted library allocation
page read and write
3810000
direct allocation
page read and write
D0D000
heap
page read and write
2BF5000
trusted library allocation
page read and write
8CA000
stack
page read and write
19BF000
heap
page read and write
5120000
heap
page read and write
3D0000
heap
page read and write
10A7000
unkown
page readonly
2BE2000
trusted library allocation
page read and write
E40000
heap
page read and write
FFA000
heap
page read and write
F60000
heap
page read and write
20FE000
stack
page read and write
C80000
heap
page read and write
3C11000
trusted library allocation
page read and write
796E000
stack
page read and write
2BF0000
trusted library allocation
page read and write
D4A000
heap
page read and write
CF6000
heap
page read and write
D6A000
heap
page read and write
E3F000
heap
page read and write
D5C000
heap
page read and write
F40C1FE000
stack
page read and write
2DB9000
trusted library allocation
page read and write
F40BFFF000
stack
page read and write
5575000
heap
page read and write
B31000
unkown
page execute read
3A3E000
direct allocation
page read and write
2CE2000
trusted library allocation
page read and write
E20000
trusted library allocation
page read and write
8E1F000
stack
page read and write
17BF000
stack
page read and write
3610000
direct allocation
page read and write
2BBB000
trusted library allocation
page read and write
2584C7D0000
heap
page read and write
109E000
unkown
page write copy
CDE000
heap
page read and write
7CE000
stack
page read and write
19BE000
heap
page read and write
36A9000
direct allocation
page read and write
2D74000
trusted library allocation
page read and write
D4A000
heap
page read and write
2584C886000
heap
page read and write
3823000
direct allocation
page read and write
52FB000
stack
page read and write
2DE6000
trusted library allocation
page read and write
B31000
unkown
page execute read
2D5B000
trusted library allocation
page read and write
33E0000
direct allocation
page read and write
39CD000
direct allocation
page read and write
EE0000
heap
page execute and read and write
39CD000
direct allocation
page read and write
535A000
heap
page read and write
CF0000
heap
page read and write
5590000
heap
page read and write
2D0E000
trusted library allocation
page read and write
33BB000
direct allocation
page read and write
3A3E000
direct allocation
page read and write
2584C9B5000
heap
page read and write
D4A000
heap
page read and write
3A3E000
direct allocation
page read and write
D1A000
heap
page read and write
3700000
direct allocation
page read and write
2DCF000
trusted library allocation
page read and write
BF7000
unkown
page readonly
FD5000
heap
page read and write
3700000
direct allocation
page read and write
373D000
direct allocation
page read and write
5580000
heap
page read and write
CE3000
heap
page read and write
There are 488 hidden memdumps, click here to show them.