Malware Analysis Report

2025-06-16 01:16

Sample ID 231207-jjd49sbef7
Target Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
SHA256 ed5f392d0095487edd0f112db6a14bbd3e9dc13454e63bf17bb0816d15e93f31
Tags
remcos zgrat remotehost rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ed5f392d0095487edd0f112db6a14bbd3e9dc13454e63bf17bb0816d15e93f31

Threat Level: Known bad

The file Payment Advice-BCS_ECS9522023032900460039_16922_952.exe was found to be: Known bad.

Malicious Activity Summary

remcos zgrat remotehost rat

Detect ZGRat V1

Remcos

ZGRat

Checks computer location settings

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Creates scheduled task(s)

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-12-07 07:41

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-12-07 07:41

Reported

2023-12-07 07:44

Platform

win7-20231023-en

Max time kernel

150s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

Remcos

rat remcos

ZGRat

rat zgrat

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2732 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2732 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2732 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2732 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2732 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2732 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2732 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2732 wrote to memory of 768 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2732 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\schtasks.exe
PID 2732 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\schtasks.exe
PID 2732 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\schtasks.exe
PID 2732 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\schtasks.exe
PID 2732 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 2732 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 2732 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 2732 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 2732 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 2732 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 2732 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 2732 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 2732 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 2732 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 2732 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 2732 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 2732 wrote to memory of 796 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe

"C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XOXpOFSvB.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XOXpOFSvB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7D5A.tmp"

C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe

"C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"

Network

Country Destination Domain Proto
US 45.128.234.54:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp

Files

memory/2732-1-0x0000000074C10000-0x00000000752FE000-memory.dmp

memory/2732-0-0x0000000000A90000-0x0000000000B9A000-memory.dmp

memory/2732-2-0x0000000004750000-0x0000000004790000-memory.dmp

memory/2732-3-0x0000000000580000-0x0000000000594000-memory.dmp

memory/2732-4-0x0000000074C10000-0x00000000752FE000-memory.dmp

memory/2732-5-0x0000000004750000-0x0000000004790000-memory.dmp

memory/2732-6-0x0000000000590000-0x000000000059C000-memory.dmp

memory/2732-7-0x00000000050D0000-0x0000000005190000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp7D5A.tmp

MD5 515c05874baad4082d2a53bda7d179fe
SHA1 3b92eb40408a67dc574de6f552979e8eaa7d5b75
SHA256 54251cb2f6fcffbcc0612c1653e12ad0f7467481f3c5f43740e2ed1393a6ff4a
SHA512 1c7ba3689ecf9a861110953aea8cec246b1f31cd6ac215cecada986b5b1cd33d56f109b7df4ca3a5e0ec059c66f7c68d454f776948ae0d1e6c81f169d59d4519

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

MD5 34c90a9909d585dcdd6c31d00d17fb46
SHA1 9d0fe33060ff6c7fd71aa5fc9c3d113ddfee40cf
SHA256 599cfa5e75564c085af6d5a64c122cb08b247342263405dfe67501d4f4d68ab6
SHA512 0b60edef3541e2f11c7aa97e1f2f3f8fe66de8a9c07bf25cf2ba154c879a966c1d2841c719b8d747ad4078f3add23191df43db483fbcc53de7811d5096139bcf

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\37OL4AUQ7GBBY7HCTDHK.temp

MD5 34c90a9909d585dcdd6c31d00d17fb46
SHA1 9d0fe33060ff6c7fd71aa5fc9c3d113ddfee40cf
SHA256 599cfa5e75564c085af6d5a64c122cb08b247342263405dfe67501d4f4d68ab6
SHA512 0b60edef3541e2f11c7aa97e1f2f3f8fe66de8a9c07bf25cf2ba154c879a966c1d2841c719b8d747ad4078f3add23191df43db483fbcc53de7811d5096139bcf

memory/2732-20-0x00000000042A0000-0x00000000042A6000-memory.dmp

memory/2732-21-0x0000000005E80000-0x0000000005F00000-memory.dmp

memory/796-22-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-24-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-26-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-28-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2752-30-0x000000006F940000-0x000000006FEEB000-memory.dmp

memory/796-31-0x0000000000400000-0x0000000000480000-memory.dmp

memory/768-33-0x000000006F940000-0x000000006FEEB000-memory.dmp

memory/768-35-0x0000000002600000-0x0000000002640000-memory.dmp

memory/2752-36-0x0000000002770000-0x00000000027B0000-memory.dmp

memory/796-38-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-34-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2752-41-0x0000000002770000-0x00000000027B0000-memory.dmp

memory/768-42-0x0000000002600000-0x0000000002640000-memory.dmp

memory/2752-43-0x0000000002770000-0x00000000027B0000-memory.dmp

memory/796-40-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-45-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/796-47-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-49-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-50-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-52-0x0000000000400000-0x0000000000480000-memory.dmp

memory/2732-51-0x0000000074C10000-0x00000000752FE000-memory.dmp

memory/796-53-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-54-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-55-0x0000000000400000-0x0000000000480000-memory.dmp

memory/768-58-0x000000006F940000-0x000000006FEEB000-memory.dmp

memory/2752-57-0x000000006F940000-0x000000006FEEB000-memory.dmp

memory/796-59-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-60-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-61-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-63-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-64-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-65-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-67-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-68-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-69-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-71-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-72-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-73-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-75-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-76-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-77-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-79-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-80-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-81-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-83-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-84-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-85-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-87-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-88-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-89-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-90-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-92-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-93-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-94-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-96-0x0000000000400000-0x0000000000480000-memory.dmp

memory/796-97-0x0000000000400000-0x0000000000480000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2023-12-07 07:41

Reported

2023-12-07 07:44

Platform

win10v2004-20231127-en

Max time kernel

150s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"

Signatures

Detect ZGRat V1

Description Indicator Process Target
N/A N/A N/A N/A

Remcos

rat remcos

ZGRat

rat zgrat

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2598572287-1024438387-935107970-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe N/A

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3940 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3940 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3940 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3940 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3940 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3940 wrote to memory of 3572 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 3940 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\schtasks.exe
PID 3940 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\schtasks.exe
PID 3940 wrote to memory of 3168 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Windows\SysWOW64\schtasks.exe
PID 3940 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 3940 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 3940 wrote to memory of 2728 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 3940 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 3940 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 3940 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 3940 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 3940 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 3940 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 3940 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 3940 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 3940 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 3940 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 3940 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe
PID 3940 wrote to memory of 4660 N/A C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe

"C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XOXpOFSvB.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XOXpOFSvB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4011.tmp"

C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe

"C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"

C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe

"C:\Users\Admin\AppData\Local\Temp\Payment Advice-BCS_ECS9522023032900460039_16922_952.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 59.128.231.4.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 34.175.53.84.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 39.142.81.104.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 208.194.73.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 58.252.72.23.in-addr.arpa udp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp
US 8.8.8.8:53 4.173.189.20.in-addr.arpa udp
N/A 127.0.0.1:56932 tcp
US 45.128.234.54:56932 tcp

Files

memory/3940-1-0x0000000075300000-0x0000000075AB0000-memory.dmp

memory/3940-0-0x0000000000BC0000-0x0000000000CCA000-memory.dmp

memory/3940-2-0x0000000005BD0000-0x0000000006174000-memory.dmp

memory/3940-3-0x00000000056C0000-0x0000000005752000-memory.dmp

memory/3940-4-0x0000000005680000-0x0000000005690000-memory.dmp

memory/3940-5-0x0000000005870000-0x000000000587A000-memory.dmp

memory/3940-6-0x0000000002F20000-0x0000000002F34000-memory.dmp

memory/3940-7-0x0000000075300000-0x0000000075AB0000-memory.dmp

memory/3940-8-0x0000000005680000-0x0000000005690000-memory.dmp

memory/3940-9-0x0000000002FB0000-0x0000000002FBC000-memory.dmp

memory/3940-10-0x00000000081F0000-0x00000000082B0000-memory.dmp

memory/3940-11-0x0000000008450000-0x00000000084EC000-memory.dmp

memory/4760-16-0x0000000004F20000-0x0000000004F56000-memory.dmp

memory/4760-18-0x0000000075300000-0x0000000075AB0000-memory.dmp

memory/4760-17-0x0000000005610000-0x0000000005C38000-memory.dmp

memory/4760-19-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

memory/3572-21-0x0000000005830000-0x0000000005852000-memory.dmp

memory/3572-22-0x00000000055E0000-0x00000000055F0000-memory.dmp

memory/3572-25-0x00000000055E0000-0x00000000055F0000-memory.dmp

memory/4760-24-0x0000000005C40000-0x0000000005CA6000-memory.dmp

memory/4760-26-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\tmp4011.tmp

MD5 186e94f3a87674fc48dd7a4f052b8ebd
SHA1 c07f63475cb6349a7ef791585789ac9cf380f65c
SHA256 f6c892732e56b30de5b4554d7fa459e3d614a992d32605ef5bc955085666e30d
SHA512 55214198f32a42b0a0a8934b266a00cc0c26525b27caa225195d1413c48f0e3bd6cc4e548252e8d5ea50cd46a3bd16fcee8d54baa03103831b1ed22a6bbe9e90

memory/3572-27-0x0000000005AE0000-0x0000000005B46000-memory.dmp

memory/3572-20-0x0000000075300000-0x0000000075AB0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ppnqhq43.4ht.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3940-46-0x00000000083F0000-0x00000000083F6000-memory.dmp

memory/3572-47-0x0000000006250000-0x00000000065A4000-memory.dmp

memory/3940-48-0x0000000008C10000-0x0000000008C90000-memory.dmp

memory/4660-49-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-50-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4760-52-0x0000000006510000-0x000000000652E000-memory.dmp

memory/4660-53-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3940-54-0x0000000075300000-0x0000000075AB0000-memory.dmp

memory/4760-55-0x0000000006A80000-0x0000000006ACC000-memory.dmp

memory/4660-57-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-58-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-59-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4760-60-0x0000000004FD0000-0x0000000004FE0000-memory.dmp

memory/4760-61-0x000000007F210000-0x000000007F220000-memory.dmp

memory/3572-63-0x000000007EEE0000-0x000000007EEF0000-memory.dmp

memory/4760-64-0x000000006FD90000-0x000000006FDDC000-memory.dmp

memory/3572-65-0x000000006FD90000-0x000000006FDDC000-memory.dmp

memory/4760-75-0x0000000006AD0000-0x0000000006AEE000-memory.dmp

memory/4760-62-0x0000000007510000-0x0000000007542000-memory.dmp

memory/4760-85-0x0000000007550000-0x00000000075F3000-memory.dmp

memory/4760-87-0x0000000007820000-0x000000000783A000-memory.dmp

memory/3572-86-0x0000000008070000-0x00000000086EA000-memory.dmp

memory/4760-88-0x0000000007890000-0x000000000789A000-memory.dmp

memory/3572-89-0x0000000007CB0000-0x0000000007D46000-memory.dmp

memory/4760-90-0x0000000007A20000-0x0000000007A31000-memory.dmp

memory/4660-91-0x0000000000400000-0x0000000000480000-memory.dmp

memory/3572-93-0x0000000007C60000-0x0000000007C6E000-memory.dmp

memory/3572-94-0x0000000007C70000-0x0000000007C84000-memory.dmp

memory/4760-96-0x0000000007B40000-0x0000000007B48000-memory.dmp

memory/4760-95-0x0000000007B60000-0x0000000007B7A000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 139fde2d3b02f5cbfb89f2b6d68660df
SHA1 dd66efa7b159bbe66ffb23a3920223611ea958a9
SHA256 25b5ca10a64ef0c138ddcaa0c983facf2e11168b101ce5b1a41a992e5280bb02
SHA512 3247276087b517556b03896e54cfb5b3970a5230b679c046dbc8aa721a8c7f554bd6d2d7e37ee2c4d53d99d7f96249cb0592327694903bf0876547bd0196ea5b

memory/4760-103-0x0000000075300000-0x0000000075AB0000-memory.dmp

memory/3572-102-0x0000000075300000-0x0000000075AB0000-memory.dmp

memory/4660-104-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-105-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-106-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-108-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-109-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-110-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-112-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-113-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-114-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-115-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-117-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-118-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-119-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-121-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-122-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-123-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-125-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-126-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-127-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-129-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-130-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-131-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-133-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-134-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-135-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-137-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-138-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-139-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-141-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-142-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-143-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-145-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-146-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-147-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-149-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-150-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-151-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-153-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-154-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-155-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-157-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-158-0x0000000000400000-0x0000000000480000-memory.dmp

memory/4660-159-0x0000000000400000-0x0000000000480000-memory.dmp