Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
rPayment_slip.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\Idonna
|
data
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\rPayment_slip.exe
|
"C:\Users\user\Desktop\rPayment_slip.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\rPayment_slip.exe"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\SysWOW64\choice.exe
|
choice /C Y /N /D Y /T 3
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://reallyfreegeoip.org
|
unknown
|
||
|
http://checkip.dyndns.org
|
unknown
|
||
|
http://checkip.dyndns.org/
|
158.101.44.242
|
||
|
http://checkip.dyndns.com
|
unknown
|
||
|
https://reallyfreegeoip.org/xml/8.46.123.33
|
188.114.96.3
|
||
|
https://reallyfreegeoip.org/xml/8.46.123.33$
|
unknown
|
||
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
||
|
http://checkip.dyndns.org/q
|
unknown
|
||
|
http://reallyfreegeoip.org
|
unknown
|
||
|
https://reallyfreegeoip.org/xml/
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
reallyfreegeoip.org
|
188.114.96.3
|
|
|
|
checkip.dyndns.org
|
unknown
|
|
|
|
checkip.dyndns.com
|
158.101.44.242
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
188.114.96.3
|
reallyfreegeoip.org
|
European Union
|
|
|
|
158.101.44.242
|
checkip.dyndns.com
|
United States
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
|
FileDirectory
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableAutoFileTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
EnableConsoleTracing
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
ConsoleTracingMask
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
MaxFileSize
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
|
FileDirectory
|
There are 5 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2F50000
|
direct allocation
|
page read and write
|
|
|
|
2821000
|
trusted library allocation
|
page read and write
|
|
|
|
762000
|
system
|
page execute and read and write
|
|
|
|
A30000
|
heap
|
page read and write
|
||
|
3BF0000
|
heap
|
page read and write
|
||
|
41F9000
|
direct allocation
|
page read and write
|
||
|
3C8A000
|
heap
|
page execute and read and write
|
||
|
31A0000
|
heap
|
page read and write
|
||
|
313F000
|
unkown
|
page read and write
|
||
|
93E000
|
stack
|
page read and write
|
||
|
29CD000
|
trusted library allocation
|
page read and write
|
||
|
BD2000
|
trusted library allocation
|
page read and write
|
||
|
3D4B000
|
heap
|
page read and write
|
||
|
3F30000
|
direct allocation
|
page read and write
|
||
|
2996000
|
trusted library allocation
|
page read and write
|
||
|
E30000
|
trusted library allocation
|
page execute and read and write
|
||
|
3849000
|
trusted library allocation
|
page read and write
|
||
|
28E8000
|
trusted library allocation
|
page read and write
|
||
|
760000
|
system
|
page execute and read and write
|
||
|
41FD000
|
direct allocation
|
page read and write
|
||
|
40D0000
|
direct allocation
|
page read and write
|
||
|
3D05000
|
heap
|
page read and write
|
||
|
3CA3000
|
heap
|
page read and write
|
||
|
9A000
|
stack
|
page read and write
|
||
|
5B8E000
|
stack
|
page read and write
|
||
|
8E0000
|
heap
|
page read and write
|
||
|
426E000
|
direct allocation
|
page read and write
|
||
|
297B000
|
trusted library allocation
|
page read and write
|
||
|
BA0000
|
trusted library allocation
|
page read and write
|
||
|
B5E000
|
stack
|
page read and write
|
||
|
E6E000
|
trusted library allocation
|
page read and write
|
||
|
291E000
|
trusted library allocation
|
page read and write
|
||
|
4100000
|
direct allocation
|
page read and write
|
||
|
968000
|
heap
|
page read and write
|
||
|
5E4F000
|
stack
|
page read and write
|
||
|
BAD000
|
trusted library allocation
|
page execute and read and write
|
||
|
31AC000
|
heap
|
page read and write
|
||
|
98B000
|
heap
|
page read and write
|
||
|
28D0000
|
trusted library allocation
|
page read and write
|
||
|
300E000
|
unkown
|
page read and write
|
||
|
3AF1000
|
heap
|
page read and write
|
||
|
317F000
|
stack
|
page read and write
|
||
|
BD7000
|
trusted library allocation
|
page execute and read and write
|
||
|
33D0000
|
heap
|
page read and write
|
||
|
41F9000
|
direct allocation
|
page read and write
|
||
|
629C000
|
stack
|
page read and write
|
||
|
BC0000
|
trusted library allocation
|
page read and write
|
||
|
A50000
|
heap
|
page read and write
|
||
|
2810000
|
heap
|
page execute and read and write
|
||
|
600E000
|
stack
|
page read and write
|
||
|
3D4B000
|
heap
|
page read and write
|
||
|
422D000
|
direct allocation
|
page read and write
|
||
|
E86000
|
trusted library allocation
|
page read and write
|
||
|
33A0000
|
heap
|
page read and write
|
||
|
1E0000
|
heap
|
page read and write
|
||
|
64FE000
|
stack
|
page read and write
|
||
|
339F000
|
stack
|
page read and write
|
||
|
29ED000
|
trusted library allocation
|
page read and write
|
||
|
E89000
|
trusted library allocation
|
page read and write
|
||
|
5BCE000
|
stack
|
page read and write
|
||
|
8F5000
|
heap
|
page read and write
|
||
|
A54000
|
heap
|
page read and write
|
||
|
4F60000
|
heap
|
page execute and read and write
|
||
|
737000
|
stack
|
page read and write
|
||
|
3D4B000
|
heap
|
page read and write
|
||
|
3B5A000
|
heap
|
page read and write
|
||
|
A15000
|
heap
|
page read and write
|
||
|
3C02000
|
heap
|
page read and write
|
||
|
5F8E000
|
stack
|
page read and write
|
||
|
3C8B000
|
heap
|
page read and write
|
||
|
EA7000
|
heap
|
page read and write
|
||
|
BC6000
|
trusted library allocation
|
page execute and read and write
|
||
|
3D4B000
|
heap
|
page read and write
|
||
|
3821000
|
trusted library allocation
|
page read and write
|
||
|
51EE000
|
stack
|
page read and write
|
||
|
3F30000
|
direct allocation
|
page read and write
|
||
|
3D19000
|
heap
|
page read and write
|
||
|
31C3000
|
heap
|
page read and write
|
||
|
63FE000
|
stack
|
page read and write
|
||
|
2F84000
|
heap
|
page read and write
|
||
|
2F80000
|
heap
|
page read and write
|
||
|
295F000
|
trusted library allocation
|
page read and write
|
||
|
100000
|
heap
|
page read and write
|
||
|
422D000
|
direct allocation
|
page read and write
|
||
|
B60000
|
heap
|
page read and write
|
||
|
BA3000
|
trusted library allocation
|
page execute and read and write
|
||
|
940000
|
heap
|
page read and write
|
||
|
BF0000
|
trusted library allocation
|
page read and write
|
||
|
317E000
|
stack
|
page read and write
|
||
|
3010000
|
heap
|
page read and write
|
||
|
4A7000
|
unkown
|
page read and write
|
||
|
A5E000
|
heap
|
page read and write
|
||
|
4083000
|
direct allocation
|
page read and write
|
||
|
4229000
|
direct allocation
|
page read and write
|
||
|
BDB000
|
trusted library allocation
|
page execute and read and write
|
||
|
429E000
|
direct allocation
|
page read and write
|
||
|
E40000
|
heap
|
page read and write
|
||
|
3D05000
|
heap
|
page read and write
|
||
|
491C000
|
stack
|
page read and write
|
||
|
28CD000
|
trusted library allocation
|
page read and write
|
||
|
3F30000
|
direct allocation
|
page read and write
|
||
|
40D0000
|
direct allocation
|
page read and write
|
||
|
3E72000
|
heap
|
page read and write
|
||
|
3D05000
|
heap
|
page read and write
|
||
|
1840000
|
heap
|
page read and write
|
||
|
50ED000
|
stack
|
page read and write
|
||
|
490000
|
unkown
|
page write copy
|
||
|
429E000
|
direct allocation
|
page read and write
|
||
|
97E000
|
heap
|
page read and write
|
||
|
3C0E000
|
heap
|
page read and write
|
||
|
4053000
|
direct allocation
|
page read and write
|
||
|
3D04000
|
heap
|
page read and write
|
||
|
41F9000
|
direct allocation
|
page read and write
|
||
|
3D05000
|
heap
|
page read and write
|
||
|
532E000
|
stack
|
page read and write
|
||
|
B90000
|
trusted library allocation
|
page read and write
|
||
|
31B8000
|
heap
|
page read and write
|
||
|
3C8B000
|
heap
|
page read and write
|
||
|
A10000
|
heap
|
page read and write
|
||
|
296B000
|
trusted library allocation
|
page read and write
|
||
|
2967000
|
trusted library allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
EA0000
|
heap
|
page read and write
|
||
|
99C000
|
heap
|
page read and write
|
||
|
28D9000
|
trusted library allocation
|
page read and write
|
||
|
A87000
|
heap
|
page read and write
|
||
|
3827000
|
trusted library allocation
|
page read and write
|
||
|
274E000
|
stack
|
page read and write
|
||
|
3F30000
|
direct allocation
|
page read and write
|
||
|
40D0000
|
direct allocation
|
page read and write
|
||
|
BA4000
|
trusted library allocation
|
page read and write
|
||
|
28C8000
|
trusted library allocation
|
page read and write
|
||
|
A89000
|
heap
|
page read and write
|
||
|
2DAD000
|
stack
|
page read and write
|
||
|
5D08000
|
heap
|
page read and write
|
||
|
3C4F000
|
heap
|
page read and write
|
||
|
9DF000
|
heap
|
page read and write
|
||
|
2FA0000
|
heap
|
page read and write
|
||
|
3D4B000
|
heap
|
page read and write
|
||
|
3F60000
|
direct allocation
|
page read and write
|
||
|
490000
|
unkown
|
page read and write
|
||
|
3010000
|
heap
|
page read and write
|
||
|
E81000
|
trusted library allocation
|
page read and write
|
||
|
970000
|
heap
|
page read and write
|
||
|
4083000
|
direct allocation
|
page read and write
|
||
|
960000
|
heap
|
page read and write
|
||
|
426E000
|
direct allocation
|
page read and write
|
||
|
3D4B000
|
heap
|
page read and write
|
||
|
3CA3000
|
heap
|
page read and write
|
||
|
2FA5000
|
heap
|
page read and write
|
||
|
2760000
|
trusted library allocation
|
page read and write
|
||
|
4AB000
|
unkown
|
page readonly
|
||
|
639C000
|
stack
|
page read and write
|
||
|
3D05000
|
heap
|
page read and write
|
||
|
3D4B000
|
heap
|
page read and write
|
||
|
3D4B000
|
heap
|
page read and write
|
||
|
63B0000
|
heap
|
page read and write
|
||
|
4AB000
|
unkown
|
page readonly
|
||
|
2922000
|
trusted library allocation
|
page read and write
|
||
|
D4E000
|
stack
|
page read and write
|
||
|
41FD000
|
direct allocation
|
page read and write
|
||
|
3D05000
|
heap
|
page read and write
|
||
|
3D4B000
|
heap
|
page read and write
|
||
|
5D3A000
|
heap
|
page read and write
|
||
|
C3E000
|
stack
|
page read and write
|
||
|
332F000
|
stack
|
page read and write
|
||
|
41FD000
|
direct allocation
|
page read and write
|
||
|
3C66000
|
heap
|
page read and write
|
||
|
5D28000
|
heap
|
page read and write
|
||
|
E2C000
|
stack
|
page read and write
|
||
|
8DD000
|
stack
|
page read and write
|
||
|
4053000
|
direct allocation
|
page read and write
|
||
|
5D1D000
|
heap
|
page read and write
|
||
|
164F000
|
stack
|
page read and write
|
||
|
5FCE000
|
stack
|
page read and write
|
||
|
426E000
|
direct allocation
|
page read and write
|
||
|
28E6000
|
trusted library allocation
|
page read and write
|
||
|
3C8B000
|
heap
|
page read and write
|
||
|
E50000
|
trusted library allocation
|
page read and write
|
||
|
181E000
|
stack
|
page read and write
|
||
|
2E6D000
|
heap
|
page read and write
|
||
|
3C8F000
|
heap
|
page read and write
|
||
|
31C5000
|
heap
|
page read and write
|
||
|
4E20000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
93E000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
5A8E000
|
stack
|
page read and write
|
||
|
312E000
|
stack
|
page read and write
|
||
|
2927000
|
trusted library allocation
|
page read and write
|
||
|
4229000
|
direct allocation
|
page read and write
|
||
|
482000
|
unkown
|
page readonly
|
||
|
9CE000
|
stack
|
page read and write
|
||
|
4083000
|
direct allocation
|
page read and write
|
||
|
8AF000
|
stack
|
page read and write
|
||
|
3D05000
|
heap
|
page read and write
|
||
|
5D13000
|
heap
|
page read and write
|
||
|
3AF0000
|
heap
|
page read and write
|
||
|
522D000
|
stack
|
page read and write
|
||
|
3130000
|
heap
|
page read and write
|
||
|
32EE000
|
stack
|
page read and write
|
||
|
3BF4000
|
heap
|
page read and write
|
||
|
40D0000
|
direct allocation
|
page read and write
|
||
|
5E8E000
|
stack
|
page read and write
|
||
|
3D05000
|
heap
|
page read and write
|
||
|
2977000
|
trusted library allocation
|
page read and write
|
||
|
E95000
|
trusted library allocation
|
page read and write
|
||
|
29A3000
|
trusted library allocation
|
page read and write
|
||
|
3F60000
|
direct allocation
|
page read and write
|
||
|
29F4000
|
trusted library allocation
|
page read and write
|
||
|
4F2E000
|
stack
|
page read and write
|
||
|
BB0000
|
trusted library allocation
|
page read and write
|
||
|
3D05000
|
heap
|
page read and write
|
||
|
A85000
|
heap
|
page read and write
|
||
|
7C0000
|
heap
|
page read and write
|
||
|
604E000
|
stack
|
page read and write
|
||
|
E64000
|
trusted library allocation
|
page read and write
|
||
|
8FE000
|
stack
|
page read and write
|
||
|
31B0000
|
heap
|
page read and write
|
||
|
4053000
|
direct allocation
|
page read and write
|
||
|
3B3B000
|
heap
|
page read and write
|
||
|
429E000
|
direct allocation
|
page read and write
|
||
|
3D05000
|
heap
|
page read and write
|
||
|
3030000
|
heap
|
page read and write
|
||
|
4D00000
|
heap
|
page read and write
|
||
|
C40000
|
heap
|
page read and write
|
||
|
4E00000
|
trusted library allocation
|
page read and write
|
||
|
BC2000
|
trusted library allocation
|
page read and write
|
||
|
A22000
|
heap
|
page read and write
|
||
|
2BF0000
|
heap
|
page read and write
|
||
|
2973000
|
trusted library allocation
|
page read and write
|
||
|
3180000
|
heap
|
page read and write
|
||
|
3F60000
|
direct allocation
|
page read and write
|
||
|
28D5000
|
trusted library allocation
|
page read and write
|
||
|
3D4B000
|
heap
|
page read and write
|
||
|
296F000
|
trusted library allocation
|
page read and write
|
||
|
5E0E000
|
stack
|
page read and write
|
||
|
8F0000
|
heap
|
page read and write
|
||
|
41F9000
|
direct allocation
|
page read and write
|
||
|
41FD000
|
direct allocation
|
page read and write
|
||
|
BCA000
|
trusted library allocation
|
page execute and read and write
|
||
|
426E000
|
direct allocation
|
page read and write
|
||
|
3AEF000
|
stack
|
page read and write
|
||
|
31C2000
|
heap
|
page read and write
|
||
|
3D05000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
3D4B000
|
heap
|
page read and write
|
||
|
124F000
|
stack
|
page read and write
|
||
|
614E000
|
stack
|
page read and write
|
||
|
E74000
|
trusted library allocation
|
page read and write
|
||
|
5CD0000
|
heap
|
page read and write
|
||
|
2988000
|
trusted library allocation
|
page read and write
|
||
|
975000
|
heap
|
page read and write
|
||
|
3D05000
|
heap
|
page read and write
|
||
|
2900000
|
trusted library allocation
|
page read and write
|
||
|
536E000
|
stack
|
page read and write
|
||
|
2EFD000
|
stack
|
page read and write
|
||
|
2D6C000
|
stack
|
page read and write
|
||
|
89F000
|
stack
|
page read and write
|
||
|
3D37000
|
heap
|
page read and write
|
||
|
4229000
|
direct allocation
|
page read and write
|
||
|
2750000
|
trusted library allocation
|
page read and write
|
||
|
4100000
|
direct allocation
|
page read and write
|
||
|
422D000
|
direct allocation
|
page read and write
|
||
|
2756000
|
trusted library allocation
|
page read and write
|
||
|
29B1000
|
trusted library allocation
|
page read and write
|
||
|
2963000
|
trusted library allocation
|
page read and write
|
||
|
34E0000
|
heap
|
page read and write
|
||
|
2B8D000
|
stack
|
page read and write
|
||
|
4100000
|
direct allocation
|
page read and write
|
||
|
5CCF000
|
stack
|
page read and write
|
||
|
27ED000
|
stack
|
page read and write
|
||
|
29D1000
|
trusted library allocation
|
page read and write
|
||
|
3C8B000
|
heap
|
page read and write
|
||
|
482000
|
unkown
|
page readonly
|
||
|
4053000
|
direct allocation
|
page read and write
|
||
|
2915000
|
trusted library allocation
|
page read and write
|
||
|
53AE000
|
stack
|
page read and write
|
||
|
63B000
|
stack
|
page read and write
|
||
|
2780000
|
trusted library allocation
|
page read and write
|
||
|
36EE000
|
stack
|
page read and write
|
||
|
A5A000
|
heap
|
page read and write
|
||
|
29DF000
|
trusted library allocation
|
page read and write
|
||
|
3D04000
|
heap
|
page read and write
|
||
|
3C5A000
|
heap
|
page read and write
|
There are 275 hidden memdumps, click here to show them.