Malware Analysis Report

2024-11-16 13:37

Sample ID 240529-netrdade26
Target Due Invoice pdf.exe
SHA256 71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d
Tags
agenttesla xworm keylogger persistence rat spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d

Threat Level: Known bad

The file Due Invoice pdf.exe was found to be: Known bad.

Malicious Activity Summary

agenttesla xworm keylogger persistence rat spyware stealer trojan

Detect Xworm Payload

AgentTesla

Xworm

Reads user/profile data of local email clients

Executes dropped EXE

Drops startup file

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Loads dropped DLL

Reads WinSCP keys stored on the system

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-29 11:19

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-29 11:19

Reported

2024-05-29 11:21

Platform

win7-20240221-en

Max time kernel

146s

Max time network

142s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Findo = "C:\\Users\\Admin\\AppData\\Roaming\\Findo.exe" C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Findo = "C:\\Users\\Admin\\AppData\\Roaming\\Findo.exe" C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2868 set thread context of 3328 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3272 set thread context of 2128 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2868 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 2868 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 2868 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 2868 wrote to memory of 3272 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 2868 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2868 wrote to memory of 3328 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3272 wrote to memory of 2128 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe

"C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe"

C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe

"C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
CY 185.205.187.173:80 185.205.187.173 tcp
CY 185.205.187.173:80 185.205.187.173 tcp
US 8.8.8.8:53 api.ipify.org udp
US 172.67.74.152:443 api.ipify.org tcp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
TR 178.215.236.251:717 tcp

Files

memory/2868-0-0x0000000074A2E000-0x0000000074A2F000-memory.dmp

memory/2868-1-0x0000000000380000-0x00000000003B4000-memory.dmp

memory/2868-2-0x0000000074A20000-0x000000007510E000-memory.dmp

memory/2868-3-0x00000000064D0000-0x0000000006716000-memory.dmp

memory/2868-15-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-4-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-5-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-57-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-7-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-9-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-11-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-13-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-17-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-19-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-55-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-67-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-65-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-63-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-61-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-59-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-53-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-51-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-49-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-47-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-45-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-43-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-41-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-39-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-37-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-35-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-33-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-31-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-29-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-27-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-25-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-23-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-21-0x00000000064D0000-0x0000000006710000-memory.dmp

memory/2868-4890-0x0000000074A20000-0x000000007510E000-memory.dmp

memory/2868-4891-0x0000000005330000-0x00000000053B2000-memory.dmp

memory/2868-4892-0x0000000004B30000-0x0000000004B7C000-memory.dmp

memory/2868-4900-0x0000000005710000-0x0000000005764000-memory.dmp

memory/3272-4901-0x0000000000A00000-0x0000000000A32000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe

MD5 f3578e8755842b11168c9cfe8d72f51e
SHA1 5973e517739c944d5e1e269f399e7bebf33fd172
SHA256 2376cb21ed4b8e05774a49512f21e1f4d3ca960df5d74865786774d000481f5b
SHA512 48b2ed8fe52bdf97d5be0d8ea75c1e4243ee2e282240041e7b7715db8dad4c5d3457a270d4b4b006b56a0641b839e54a24a879ddb4526e5e961d8700829d3a29

memory/3272-4903-0x0000000074A20000-0x000000007510E000-memory.dmp

memory/3272-4904-0x0000000074A20000-0x000000007510E000-memory.dmp

memory/2868-4917-0x0000000074A20000-0x000000007510E000-memory.dmp

memory/3328-4916-0x0000000000400000-0x0000000000440000-memory.dmp

memory/3272-4918-0x00000000061D0000-0x00000000063F0000-memory.dmp

memory/3272-9805-0x0000000005D10000-0x0000000005D6C000-memory.dmp

memory/3272-9806-0x0000000074A20000-0x000000007510E000-memory.dmp

\??\c:\users\admin\appdata\roaming\findo.exe

MD5 06f89bea6cec0ee3459c26732c6f4d40
SHA1 077c773301223d98b07630487facd24710353335
SHA256 71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d
SHA512 a172753e363467928c9bf700f36865eb53ab5ea85dcbf7bb3fa8bc756f130eacf3ba194f8b25707203b55e8b84a256f756e27a17cce4f81991e9cc2c31353d6b

memory/2128-9821-0x0000000000400000-0x0000000000412000-memory.dmp

memory/3272-9822-0x0000000074A20000-0x000000007510E000-memory.dmp

\Users\Admin\AppData\Roaming\XClient.exe

MD5 b58b926c3574d28d5b7fdd2ca3ec30d5
SHA1 d260c4ffd603a9cfc057fcb83d678b1cecdf86f9
SHA256 6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3
SHA512 b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-29 11:19

Reported

2024-05-29 11:21

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe"

Signatures

AgentTesla

keylogger trojan stealer spyware agenttesla

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A

Xworm

trojan rat xworm

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A

Reads WinSCP keys stored on the system

spyware stealer

Reads data files stored by FTP clients

spyware stealer

Reads user/profile data of local email clients

spyware stealer

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Findo = "C:\\Users\\Admin\\AppData\\Roaming\\Findo.exe" C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Findo = "C:\\Users\\Admin\\AppData\\Roaming\\Findo.exe" C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.ipify.org N/A N/A
N/A api.ipify.org N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3276 set thread context of 3696 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 set thread context of 4932 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3276 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 3276 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 3276 wrote to memory of 2076 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe
PID 3276 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3276 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3276 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3276 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3276 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3276 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3276 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 3276 wrote to memory of 3696 N/A C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
PID 2076 wrote to memory of 4932 N/A C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Processes

C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe

"C:\Users\Admin\AppData\Local\Temp\Due Invoice pdf.exe"

C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe

"C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"

Network

Country Destination Domain Proto
CY 185.205.187.173:80 185.205.187.173 tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 173.187.205.185.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
CY 185.205.187.173:80 185.205.187.173 tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 api.ipify.org udp
US 104.26.13.205:443 api.ipify.org tcp
US 8.8.8.8:53 205.13.26.104.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 api.telegram.org udp
NL 149.154.167.220:443 api.telegram.org tcp
US 8.8.8.8:53 220.167.154.149.in-addr.arpa udp
TR 178.215.236.251:717 tcp
US 8.8.8.8:53 251.236.215.178.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/3276-0-0x0000000074E2E000-0x0000000074E2F000-memory.dmp

memory/3276-1-0x0000000000360000-0x0000000000394000-memory.dmp

memory/3276-2-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/3276-3-0x0000000005E40000-0x0000000006086000-memory.dmp

memory/3276-4-0x0000000006630000-0x0000000006BD4000-memory.dmp

memory/3276-5-0x0000000006180000-0x0000000006212000-memory.dmp

memory/3276-13-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-19-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-39-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-37-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-51-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-69-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-67-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-65-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-63-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-62-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-59-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-57-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-55-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-53-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-50-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-45-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-43-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-41-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-35-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-33-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-32-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-29-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-47-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-27-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-25-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-23-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-21-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-17-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-15-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-11-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-9-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-7-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-6-0x0000000005E40000-0x0000000006080000-memory.dmp

memory/3276-4892-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/3276-4893-0x0000000005780000-0x0000000005802000-memory.dmp

memory/3276-4894-0x0000000005D40000-0x0000000005D8C000-memory.dmp

memory/3276-4895-0x00000000062B0000-0x0000000006316000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Pdmyfgbmmsc.exe

MD5 f3578e8755842b11168c9cfe8d72f51e
SHA1 5973e517739c944d5e1e269f399e7bebf33fd172
SHA256 2376cb21ed4b8e05774a49512f21e1f4d3ca960df5d74865786774d000481f5b
SHA512 48b2ed8fe52bdf97d5be0d8ea75c1e4243ee2e282240041e7b7715db8dad4c5d3457a270d4b4b006b56a0641b839e54a24a879ddb4526e5e961d8700829d3a29

memory/3276-4907-0x00000000063F0000-0x0000000006444000-memory.dmp

memory/2076-4909-0x00000000008A0000-0x00000000008D2000-memory.dmp

memory/2076-4910-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/2076-4913-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/3276-4914-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/3696-4916-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/3696-4915-0x0000000000400000-0x0000000000440000-memory.dmp

memory/3696-4917-0x00000000062A0000-0x00000000062F0000-memory.dmp

memory/3696-4918-0x0000000006310000-0x000000000631A000-memory.dmp

memory/2076-4919-0x0000000006240000-0x0000000006460000-memory.dmp

memory/2076-9806-0x0000000005B90000-0x0000000005BEC000-memory.dmp

memory/2076-9807-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/3696-9808-0x0000000074E20000-0x00000000755D0000-memory.dmp

\??\c:\users\admin\appdata\roaming\findo.exe

MD5 06f89bea6cec0ee3459c26732c6f4d40
SHA1 077c773301223d98b07630487facd24710353335
SHA256 71540af9f3dd877a91cd506fb2efb0ebb4211c4370c8edb74185a5b9554bb66d
SHA512 a172753e363467928c9bf700f36865eb53ab5ea85dcbf7bb3fa8bc756f130eacf3ba194f8b25707203b55e8b84a256f756e27a17cce4f81991e9cc2c31353d6b

memory/2076-9813-0x0000000074E20000-0x00000000755D0000-memory.dmp

memory/4932-9814-0x0000000000400000-0x0000000000412000-memory.dmp

memory/4932-9815-0x0000000004F50000-0x0000000004FEC000-memory.dmp