IOC Report
Outstanding payment.exe

Outstanding payment.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

initial sample

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Outstanding payment.exe.log

ASCII text, with CRLF line terminators

dropped

C:\Users\user\AppData\Local\Temp\tmpE0D0.tmp

XML 1.0 document, ASCII text

dropped

C:\Users\user\AppData\Roaming\iBSWjb.exe

PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

dropped

C:\Users\user\AppData\Roaming\iBSWjb.exe:Zone.Identifier

ASCII text, with CRLF line terminators

dropped

C:\Users\user\Desktop\Outstanding payment.exe

"C:\Users\user\Desktop\Outstanding payment.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Outstanding payment.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\iBSWjb.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iBSWjb" /XML "C:\Users\user\AppData\Local\Temp\tmpE0D0.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\explorer.exe

C:\Windows\Explorer.EXE

C:\Users\user\AppData\Roaming\iBSWjb.exe

C:\Users\user\AppData\Roaming\iBSWjb.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iBSWjb" /XML "C:\Users\user\AppData\Local\Temp\tmpF30F.tmp"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"

C:\Windows\SysWOW64\msiexec.exe

"C:\Windows\SysWOW64\msiexec.exe"

http://www.dj1.lat/a03d/

unknown

http://www.istromarmitaria.online/a03d/

unknown

http://www.nfluencer-marketing-13524.bond/a03d/www.atidiri.fun

unknown

http://www.otelhafnia.info/a03d/www.kkkk.shop

unknown

www.enelog.xyz/a03d/

http://www.istromarmitaria.online/a03d/www.dj1.lat

unknown

http://www.dj1.lat/a03d/j

unknown

http://www.enelog.xyz/a03d/

unknown

http://www.enelog.xyz/a03d/www.72266.vip

unknown