Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
elevation_service.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
initial sample
|
||
|
C:\servicereg.log
|
ASCII text, with CRLF line terminators
|
modified
|
 |
|
|
C:\servicestart.log
|
ASCII text, with CRLF line terminators
|
modified
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\SysWOW64\cmd.exe
|
cmd /c sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe" >> C:\servicereg.log 2>&1
|
|
|
|
C:\Windows\SysWOW64\sc.exe
|
sc create OZgQJ binpath= "C:\Users\user\Desktop\elevation_service.exe"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
cmd /c sc start OZgQJ >> C:\servicestart.log 2>&1
|
|
|
|
C:\Windows\SysWOW64\sc.exe
|
sc start OZgQJ
|
|
|
|
C:\Users\user\Desktop\elevation_service.exe
|
C:\Users\user\Desktop\elevation_service.exe
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ffDilithium2Dilith
|
unknown
|
||
|
https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
33A8000
|
heap
|
page read and write
|
||
|
3090000
|
heap
|
page read and write
|
||
|
2DED000
|
stack
|
page read and write
|
||
|
558000220000
|
direct allocation
|
page read and write
|
||
|
1CA6D550000
|
heap
|
page read and write
|
||
|
1CA6D613000
|
heap
|
page read and write
|
||
|
2B6C2FE000
|
stack
|
page read and write
|
||
|
558000201000
|
direct allocation
|
page read and write
|
||
|
558000244000
|
direct allocation
|
page read and write
|
||
|
1CA6D560000
|
heap
|
page read and write
|
||
|
7FF723431000
|
unkown
|
page execute read
|
||
|
558000288000
|
direct allocation
|
page read and write
|
||
|
7FF7235E0000
|
unkown
|
page read and write
|
||
|
1CA6D600000
|
heap
|
page read and write
|
||
|
7FF7235CB000
|
unkown
|
page read and write
|
||
|
5580002C0000
|
direct allocation
|
page read and write
|
||
|
3238000
|
heap
|
page read and write
|
||
|
7FF7235FA000
|
unkown
|
page readonly
|
||
|
2B6C1FE000
|
stack
|
page read and write
|
||
|
7FF7235E6000
|
unkown
|
page readonly
|
||
|
7FF723431000
|
unkown
|
page execute read
|
||
|
1CA6D62D000
|
heap
|
page read and write
|
||
|
7FF7235DA000
|
unkown
|
page read and write
|
||
|
7FF7235FA000
|
unkown
|
page readonly
|
||
|
3230000
|
heap
|
page read and write
|
||
|
303E000
|
stack
|
page read and write
|
||
|
558000250000
|
direct allocation
|
page read and write
|
||
|
5580002AC000
|
direct allocation
|
page read and write
|
||
|
3640000
|
heap
|
page read and write
|
||
|
3060000
|
heap
|
page read and write
|
||
|
34A0000
|
heap
|
page read and write
|
||
|
2B6C5FE000
|
stack
|
page read and write
|
||
|
1CA6D530000
|
heap
|
page read and write
|
||
|
2D00000
|
heap
|
page read and write
|
||
|
30FF000
|
stack
|
page read and write
|
||
|
7FF72358E000
|
unkown
|
page readonly
|
||
|
7FF7235CB000
|
unkown
|
page write copy
|
||
|
558000234000
|
direct allocation
|
page read and write
|
||
|
322E000
|
stack
|
page read and write
|
||
|
7FF7235F8000
|
unkown
|
page execute read
|
||
|
2B6C0FD000
|
stack
|
page read and write
|
||
|
30BE000
|
stack
|
page read and write
|
||
|
558000210000
|
direct allocation
|
page read and write
|
||
|
5580002A8000
|
direct allocation
|
page read and write
|
||
|
7FF7235CC000
|
unkown
|
page write copy
|
||
|
558000264000
|
direct allocation
|
page read and write
|
||
|
336F000
|
stack
|
page read and write
|
||
|
C3D000
|
stack
|
page read and write
|
||
|
558000274000
|
direct allocation
|
page read and write
|
||
|
7FF7235DA000
|
unkown
|
page write copy
|
||
|
2DAD000
|
stack
|
page read and write
|
||
|
558000284000
|
direct allocation
|
page read and write
|
||
|
558000268000
|
direct allocation
|
page read and write
|
||
|
7FF723430000
|
unkown
|
page readonly
|
||
|
558000230000
|
direct allocation
|
page read and write
|
||
|
7FF7235CE000
|
unkown
|
page read and write
|
||
|
7FF7235E6000
|
unkown
|
page readonly
|
||
|
2B6C6FE000
|
stack
|
page read and write
|
||
|
3050000
|
heap
|
page read and write
|
||
|
558000294000
|
direct allocation
|
page read and write
|
||
|
7FF72358E000
|
unkown
|
page readonly
|
||
|
558000254000
|
direct allocation
|
page read and write
|
||
|
1CA6D702000
|
heap
|
page read and write
|
||
|
1CA6D702000
|
heap
|
page read and write
|
||
|
2DE0000
|
heap
|
page read and write
|
||
|
33A0000
|
heap
|
page read and write
|
||
|
307F000
|
stack
|
page read and write
|
||
|
7FF7235F8000
|
unkown
|
page execute read
|
||
|
1CA6D570000
|
heap
|
page read and write
|
||
|
2B6C4FF000
|
stack
|
page read and write
|
||
|
1CA6D602000
|
heap
|
page read and write
|
||
|
31F0000
|
heap
|
page read and write
|
||
|
5580002C8000
|
direct allocation
|
page read and write
|
||
|
31AE000
|
stack
|
page read and write
|
||
|
7FF723430000
|
unkown
|
page readonly
|
||
|
C7E000
|
stack
|
page read and write
|
||
|
31EF000
|
stack
|
page read and write
|
||
|
1CA6D640000
|
heap
|
page read and write
|
There are 68 hidden memdumps, click here to show them.