IOC Report
qZJOfO5jjs

loading gif

Files

File Path
Type
Category
Malicious
qZJOfO5jjs.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\Desktop\myd3d.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\qZJOfO5jjs.exe
"C:\Users\user\Desktop\qZJOfO5jjs.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
cmd.exe /c netsh advfirewall firewall delete rule name="benshan"
 malicious
C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall delete rule name="benshan"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://dywt.com.cnservice
unknown
http://www.openssl.org/support/faq.htmlRAND
unknown
http://cs-g2-crl.thawte.com/ThawteCSG2.crl0
unknown
http://crl.thawte.com/ThawtePCA.crl0
unknown
http://ocsp.thawte.com0
unknown
http://dywt.com.cn
unknown
http://www.openssl.org/support/faq.html
unknown

IPs

IP
Domain
Country
Malicious
127.0.0.1
unknown
unknown

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Multimedia\DrawDib
1280x1024x32(BGR 0)

Memdumps

Base Address
Regiontype
Protect
Malicious
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2EBF000
stack
page read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
25F4000
heap
page read and write
817000
heap
page read and write
267E000
stack
page read and write
92000
stack
page read and write
2FC0000
trusted library allocation
page read and write
73B000
unkown
page read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
263E000
stack
page read and write
2600000
trusted library allocation
page read and write
723000
unkown
page write copy
A3E000
stack
page read and write
2600000
trusted library allocation
page read and write
2789000
heap
page read and write
CF0000
heap
page read and write
2600000
trusted library allocation
page read and write
25C0000
heap
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
83E000
heap
page read and write
2600000
trusted library allocation
page read and write
2570000
heap
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
783000
unkown
page readonly
2580000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
400000
unkown
page readonly
4F1000
unkown
page readonly
4FE000
unkown
page readonly
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2685000
heap
page read and write
255C000
heap
page read and write
71F000
unkown
page read and write
714000
unkown
page read and write
2600000
trusted library allocation
page read and write
2540000
direct allocation
page execute and read and write
2600000
trusted library allocation
page read and write
72F000
unkown
page read and write
820000
heap
page read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2FBF000
stack
page read and write
2FC0000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2548000
direct allocation
page execute and read and write
2BC0000
heap
page read and write
2600000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
D33000
direct allocation
page execute and read and write
7A0000
heap
page read and write
712000
unkown
page write copy
712000
unkown
page write copy
D28000
direct allocation
page execute and read and write
2600000
trusted library allocation
page read and write
7B0000
heap
page read and write
2FC0000
trusted library allocation
page read and write
817000
heap
page read and write
2600000
trusted library allocation
page read and write
B3F000
stack
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
77B000
unkown
page read and write
2FC0000
trusted library allocation
page read and write
19C000
stack
page read and write
810000
heap
page read and write
781000
unkown
page read and write
2BC1000
heap
page read and write
4F1000
unkown
page readonly
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
783000
unkown
page readonly
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2680000
heap
page read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
817000
heap
page read and write
8C2000
heap
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
D10000
direct allocation
page execute and read and write
2600000
trusted library allocation
page read and write
72F000
unkown
page write copy
2FC0000
trusted library allocation
page read and write
8CE000
heap
page read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
25F0000
heap
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2590000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
748000
unkown
page read and write
2FC0000
trusted library allocation
page read and write
83A000
heap
page read and write
2780000
heap
page read and write
2FC0000
trusted library allocation
page read and write
815000
heap
page read and write
2FC0000
trusted library allocation
page read and write
2510000
direct allocation
page execute and read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
2FC0000
trusted library allocation
page read and write
830000
heap
page read and write
72B000
unkown
page read and write
401000
unkown
page execute read
2FC0000
trusted library allocation
page read and write
253E000
direct allocation
page execute and read and write
2BC1000
heap
page read and write
400000
unkown
page readonly
2CC3000
heap
page read and write
716000
unkown
page write copy
2600000
trusted library allocation
page read and write
2600000
trusted library allocation
page read and write
8BB000
heap
page read and write
4FE000
unkown
page readonly
2600000
trusted library allocation
page read and write
8BC000
heap
page read and write
D6E000
heap
page read and write
2FC0000
trusted library allocation
page read and write
401000
unkown
page execute read
2FC0000
trusted library allocation
page read and write
D2B000
direct allocation
page execute and read and write
2BC1000
heap
page read and write
754000
unkown
page read and write
253C000
direct allocation
page execute and read and write
D60000
heap
page read and write
There are 165 hidden memdumps, click here to show them.