Malware Analysis Report

2024-11-16 13:37

Sample ID 240529-nbpm9add29
Target Due Invoice pdf.exe
SHA256 71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d
Tags
agenttesla xworm keylogger persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d

Threat Level: Known bad

The file Due Invoice pdf.exe was found to be: Known bad.

Malicious Activity Summary

agenttesla xworm keylogger persistence rat spyware stealer trojan

Detect Xworm Payload

Xworm

AgentTesla

Reads user/profile data of web browsers

Reads user/profile data of local email clients

Executes dropped EXE

Checks computer location settings

Drops startup file

Loads dropped DLL

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-29 11:13

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-29 11:13

Reported

2024-05-29 11:16

Platform

win7-20240221-en

Max time kernel

147s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Findo = "C:\\Users\\Admin\\AppData\\Roaming\\Findo.exe" C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Findo = "C:\\Users\\Admin\\AppData\\Roaming\\Findo.exe" C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1368 set thread context of 3360 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3264 set thread context of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1368 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 1368 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 1368 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 1368 wrote to memory of 3264 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 1368 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1368 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1368 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1368 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1368 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1368 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1368 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1368 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1368 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1368 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1368 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 1368 wrote to memory of 3360 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3264 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3264 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3264 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3264 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3264 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3264 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3264 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3264 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3264 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3264 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3264 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3264 wrote to memory of 1616 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe

"C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe"

C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe

"C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
CY 185.205.187.173:80 185.205.187.173 tcp
CY 185.205.187.173:80 185.205.187.173 tcp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.12.205:443 api.ipify.org tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
TR 178.215.236.251:717 tcp

Files

memory/1368-0-0x0000000074A4E000-0x0000000074A4F000-memory.dmp

memory/1368-1-0x0000000001190000-0x00000000011C4000-memory.dmp

memory/1368-2-0x0000000074A40000-0x000000007512E000-memory.dmp

memory/1368-3-0x0000000006290000-0x00000000064D6000-memory.dmp

memory/1368-4-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-5-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-7-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-9-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-11-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-16-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-35-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-33-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-31-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-29-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-27-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-25-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-23-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-21-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-20-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-17-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-50-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-14-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-61-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-63-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-59-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-67-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-65-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-57-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-55-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-53-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-51-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-47-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-45-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-43-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-41-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-40-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-37-0x0000000006290000-0x00000000064D0000-memory.dmp

memory/1368-4892-0x0000000074A40000-0x000000007512E000-memory.dmp

memory/1368-4891-0x00000000052C0000-0x000000000530C000-memory.dmp

memory/1368-4890-0x00000000051F0000-0x0000000005272000-memory.dmp

memory/3264-4901-0x0000000000190000-0x00000000001C2000-memory.dmp

memory/1368-4900-0x00000000057B0000-0x0000000005804000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe

MD5 f3578e8755842b11168c9cfe8d72f51e
SHA1 5973e517739c944d5e1e269f399e7bebf33fd172
SHA256 2376cb21ed4b8e05774a49512f21e1f4d3ca960df5d74865786774d000481f5b
SHA512 48b2ed8fe52bdf97d5be0d8ea75c1e4243ee2e282240041e7b7715db8dad4c5d3457a270d4b4b006b56a0641b839e54a24a879ddb4526e5e961d8700829d3a29

memory/3264-4902-0x0000000074A40000-0x000000007512E000-memory.dmp

memory/3264-4904-0x0000000074A40000-0x000000007512E000-memory.dmp

memory/1368-4917-0x0000000074A40000-0x000000007512E000-memory.dmp

memory/3360-4916-0x0000000000400000-0x0000000000440000-memory.dmp

memory/3264-4918-0x0000000006230000-0x0000000006450000-memory.dmp

memory/3264-9805-0x0000000005260000-0x00000000052BC000-memory.dmp

memory/3264-9806-0x0000000074A40000-0x000000007512E000-memory.dmp

\??\c:\users\admin\appdata\roaming\findo.exe

MD5 9d4dcf280bb10cd4bd030bfd87b14ff9
SHA1 20393d494e912ddea7036d95963f9783e40f7462
SHA256 2c256b37acab51690ca4d1e6cfe3cb74e421f7fbff011a2d29b4c3f406961181
SHA512 8d1205220d6bc09d44a0601ffd7535dfe4b76eb685b3a49cee9db0c74ea72c59ccb15f9c10a33004ec5e1fc3af2f7a66f2cb57fa0f7a873d045b8229d09272a5

memory/1616-9821-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3264-9822-0x0000000074A40000-0x000000007512E000-memory.dmp

\Users\Admin\AppData\Roaming\XClient.exe

MD5 b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1 d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA256 6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512 b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-29 11:13

Reported

2024-05-29 11:16

Platform

win10v2004-20240426-en

Max time kernel

146s

Max time network

146s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Findo = "C:\\Users\\Admin\\AppData\\Roaming\\Findo.exe" C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Findo = "C:\\Users\\Admin\\AppData\\Roaming\\Findo.exe" C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4672 set thread context of 4324 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2664 set thread context of 3284 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4672 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 4672 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 4672 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 4672 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4672 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4672 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4672 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4672 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4672 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4672 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 4672 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2664 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2664 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2664 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2664 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2664 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2664 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2664 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2664 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe

"C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe"

C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe

"C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 25.24.18.2.in-addr.arpa udp
CY 185.205.187.173:80 185.205.187.173 tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 173.187.205.185.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
CY 185.205.187.173:80 185.205.187.173 tcp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.13.205:443 api.ipify.org tcp
US 8.8.8.8:53 205.13.26.104.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 18.24.18.2.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
TR 178.215.236.251:717 tcp
US 8.8.8.8:53 251.236.215.178.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/4672-0-0x00000000750DE000-0x00000000750DF000-memory.dmp

memory/4672-1-0x00000000009A0000-0x00000000009D4000-memory.dmp

memory/4672-2-0x00000000750D0000-0x0000000075880000-memory.dmp

memory/4672-3-0x0000000006490000-0x00000000066D6000-memory.dmp

memory/4672-4-0x0000000006C80000-0x0000000007224000-memory.dmp

memory/4672-5-0x00000000067C0000-0x0000000006852000-memory.dmp

memory/4672-7-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-6-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-13-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-27-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-25-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-23-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-21-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-19-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-18-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-11-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-9-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-15-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-31-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-29-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-39-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-65-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-57-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-55-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-69-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-67-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-63-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-61-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-59-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-53-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-51-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-49-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-47-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-45-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-43-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-37-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-35-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-33-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-41-0x0000000006490000-0x00000000066D0000-memory.dmp

memory/4672-4892-0x00000000750D0000-0x0000000075880000-memory.dmp

memory/4672-4893-0x0000000005DD0000-0x0000000005E52000-memory.dmp

memory/4672-4894-0x0000000006390000-0x00000000063DC000-memory.dmp

memory/4672-4895-0x00000000068F0000-0x0000000006956000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe

MD5 f3578e8755842b11168c9cfe8d72f51e
SHA1 5973e517739c944d5e1e269f399e7bebf33fd172
SHA256 2376cb21ed4b8e05774a49512f21e1f4d3ca960df5d74865786774d000481f5b
SHA512 48b2ed8fe52bdf97d5be0d8ea75c1e4243ee2e282240041e7b7715db8dad4c5d3457a270d4b4b006b56a0641b839e54a24a879ddb4526e5e961d8700829d3a29

memory/2664-4908-0x00000000003B0000-0x00000000003E2000-memory.dmp

memory/2664-4910-0x00000000750D0000-0x0000000075880000-memory.dmp

memory/4672-4907-0x0000000006A30000-0x0000000006A84000-memory.dmp

memory/2664-4913-0x00000000750D0000-0x0000000075880000-memory.dmp

memory/4672-4914-0x00000000750D0000-0x0000000075880000-memory.dmp

memory/4324-4916-0x00000000750D0000-0x0000000075880000-memory.dmp

memory/4324-4915-0x0000000000400000-0x0000000000440000-memory.dmp

memory/4324-4917-0x0000000006530000-0x0000000006580000-memory.dmp

memory/4324-4918-0x00000000065A0000-0x00000000065AA000-memory.dmp

memory/2664-4919-0x0000000005D50000-0x0000000005F70000-memory.dmp

memory/2664-9806-0x00000000056C0000-0x000000000571C000-memory.dmp

memory/2664-9807-0x00000000750D0000-0x0000000075880000-memory.dmp

memory/4324-9808-0x00000000750D0000-0x0000000075880000-memory.dmp

\??\c:\users\admin\appdata\roaming\findo.exe

MD5 33d2128a357211d5e715744eacb02cd2
SHA1 5e65c9b2448699acce698bc583db4c9a0068f6ed
SHA256 f52a9d91629ba5fe8497ac97aa8268b1fc9560007fd227afc00bf4382b9711c5
SHA512 aaac8ff82c0b28baf69ec6813475e3c2dda71eb2b81b4d93080ce1af1a193863b2ba02194d6ced3d6a48715989f9fbb93bc69f32aea9ae42d05abef389c912dd

memory/2664-9813-0x00000000750D0000-0x0000000075880000-memory.dmp

memory/3284-9815-0x0000000004B70000-0x0000000004C0C000-memory.dmp

memory/3284-9814-0x0000000000380000-0x0000000000392000-memory.dmp