IOC Report
SecuriteInfo.com.W32.DriverTalent.A.gen.Eldorado.3883.7584.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.W32.DriverTalent.A.gen.Eldorado.3883.7584.exe
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\DTInstUI.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\instlan\Armenian.ini
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\instlan\Bulgarian.ini
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\instlan\English.ini
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\instlan\French.ini
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\instlan\German.ini
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\instlan\Greek.ini
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\instlan\Japanese.ini
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\instlan\Polish.ini
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\instlan\Portuguese.ini
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\instlan\Russian.ini
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\instlan\Spanish.ini
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\instlan\Turkish.ini
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\pcid.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\softconfig.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Temp\Hot96EC.tmp\substat.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
There are 7 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.W32.DriverTalent.A.gen.Eldorado.3883.7584.exe
"C:\Users\user\Desktop\SecuriteInfo.com.W32.DriverTalent.A.gen.Eldorado.3883.7584.exe"
 malicious

URLs

Name
IP
Malicious
http://www.ostoto.com/web/install/%d/1d?/
unknown
http://int.updrv.com/dtl/server.ashx?type=%d
unknown
http://www.ostoto.com/licence/EULA-for-OSToto-Driver-Talent.html3
unknown
http://www.openssl.org/support/faq.html....................
unknown
http://www.symauth.com/rpa00
unknown
http://install.integrate.drivethelife.com/common/IntegrateInstallStat.ashx.
unknown
http://bbs.160.com/forum-66-1.html
unknown
https://d.sy
unknown
http://int.softconfig.drivethelife.com/server.ashx?type=%d
unknown
http://www.drivethelife.com/
unknown
http://install.integrate.drivethelife.com/common/IntegrateInstallStat.ashx
unknown
http://www.ostoto.com/web/uninstall/%d/1
unknown
http://bbs.160.com/forum-66-1.html0
unknown
http://www.symauth.com/cps0(
unknown
http://int.updrv.com/common/IntegrateUnInstallStat.ashx
unknown
http://www.drivethelife.com/EULA.html
unknown
http://www.ostoto.com/web/install/%d/1
unknown
https://curl.haxx.se/docs/http-cookies.html
unknown
http://www.openssl.org/support/faq.html
unknown
http://int.softconfig.drivethelife.com/server.ashx?type=%dhttp://int.updrv.com/dtl/server.ashx?type=
unknown
http://www.drivethelife.com/D
unknown
http://www.ostoto.com/licence/EULA-for-OSToto-Driver-Talent.html
unknown
There are 12 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
online1.integrate.drivethelife.com
209.58.131.173
dispatch.integrate.drivethelife.com
209.58.131.173
behaviorgather.integrate.drivethelife.com
209.58.131.173
int.softconfig.drivethelife.com
unknown

IPs

IP
Domain
Country
Malicious
209.58.131.173
online1.integrate.drivethelife.com
United States

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46
Blob

Memdumps

Base Address
Regiontype
Protect
Malicious
4F5B000
heap
page read and write
4FFD000
heap
page read and write
4100000
heap
page read and write
E20000
unkown
page readonly
E10000
heap
page read and write
4F95000
heap
page read and write
4FC3000
heap
page read and write
4F62000
heap
page read and write
54C6000
heap
page read and write
54DD000
heap
page read and write
5C99000
heap
page read and write
6D2EC000
unkown
page read and write
54E9000
heap
page read and write
57C7000
heap
page read and write
44BB000
heap
page read and write
4F54000
heap
page read and write
5730000
trusted library allocation
page read and write
4EAD000
heap
page read and write
BFE000
heap
page read and write
4F62000
heap
page read and write
1ACF000
unkown
page read and write
54DD000
heap
page read and write
4F67000
heap
page read and write
54E6000
heap
page read and write
B75000
heap
page read and write
54CE000
heap
page read and write
54C1000
heap
page read and write
B1E000
stack
page read and write
4F4D000
heap
page read and write
8E0000
heap
page read and write
4F67000
heap
page read and write
B56000
stack
page read and write
440B000
heap
page read and write
54CE000
heap
page read and write
5730000
trusted library allocation
page read and write
4F9000
stack
page read and write
4FD2000
heap
page read and write
4F67000
heap
page read and write
1ACE000
unkown
page execute and write copy
4F54000
heap
page read and write
5730000
trusted library allocation
page read and write
BF0000
heap
page read and write
51DB000
stack
page read and write
5730000
trusted library allocation
page read and write
4F50000
heap
page read and write
4F67000
heap
page read and write
4F81000
heap
page read and write
51EA000
heap
page read and write
6E86D000
unkown
page readonly
6D222000
unkown
page read and write
6E873000
unkown
page read and write
54CA000
heap
page read and write
1EB000
stack
page read and write
4F65000
heap
page read and write
6E0000
heap
page read and write
4F67000
heap
page read and write
40DE000
stack
page read and write
4BFC000
stack
page read and write
4495000
heap
page read and write
54E6000
heap
page read and write
5730000
trusted library allocation
page read and write
4A7F000
stack
page read and write
8EA000
heap
page read and write
4F5C000
heap
page read and write
4F52000
heap
page read and write
4F67000
heap
page read and write
951000
heap
page read and write
4F81000
heap
page read and write
E9A000
unkown
page execute and read and write
4F62000
heap
page read and write
42CE000
stack
page read and write
4F5B000
heap
page read and write
4FE2000
heap
page read and write
42FA000
heap
page read and write
4F66000
heap
page read and write
53D8000
heap
page read and write
5730000
trusted library allocation
page read and write
930000
heap
page read and write
6D2F2000
unkown
page readonly
4E91000
heap
page read and write
4F65000
heap
page read and write
4E9A000
heap
page read and write
4F4E000
heap
page read and write
4F5B000
heap
page read and write
E21000
unkown
page execute and read and write
4F64000
heap
page read and write
1A98000
unkown
page execute and write copy
5270000
heap
page read and write
4F65000
heap
page read and write
4E83000
heap
page read and write
5B4F000
stack
page read and write
26D8000
unkown
page read and write
4F65000
heap
page read and write
6E851000
unkown
page execute read
5730000
trusted library allocation
page read and write
4F5B000
heap
page read and write
E20000
unkown
page readonly
45FE000
stack
page read and write
5730000
trusted library allocation
page read and write
4F40000
heap
page read and write
1ACB000
unkown
page execute and read and write
6D1BD000
unkown
page readonly
4F5E000
heap
page read and write
860000
heap
page read and write
4F4C000
heap
page read and write
5730000
trusted library allocation
page read and write
6D2BA000
unkown
page readonly
53BE000
stack
page read and write
6D227000
unkown
page readonly
5730000
trusted library allocation
page read and write
4F95000
heap
page read and write
8EE000
heap
page read and write
504E000
heap
page read and write
4E40000
heap
page read and write
8AE000
stack
page read and write
52B0000
heap
page read and write
4E92000
heap
page read and write
54C1000
heap
page read and write
4F50000
heap
page read and write
42F0000
heap
page read and write
4F65000
heap
page read and write
54C8000
heap
page read and write
5B8E000
stack
page read and write
54C7000
heap
page read and write
54C5000
heap
page read and write
4F5B000
heap
page read and write
5730000
trusted library allocation
page read and write
54CB000
heap
page read and write
BF7000
heap
page read and write
24CF000
unkown
page write copy
4F67000
heap
page read and write
6E877000
unkown
page readonly
4F90000
heap
page read and write
42FC000
heap
page read and write
5731000
heap
page read and write
4F98000
heap
page read and write
4F4C000
heap
page read and write
5730000
trusted library allocation
page read and write
4F5B000
heap
page read and write
4FD2000
heap
page read and write
4106000
heap
page read and write
550000
heap
page read and write
948000
heap
page read and write
42F7000
heap
page read and write
54CB000
heap
page read and write
4E96000
heap
page read and write
46FE000
stack
page read and write
4F95000
heap
page read and write
6D21B000
unkown
page write copy
4F4D000
heap
page read and write
951000
heap
page read and write
42F9000
heap
page read and write
50FF000
heap
page read and write
4EA5000
heap
page read and write
4F64000
heap
page read and write
4F55000
heap
page read and write
4F5F000
heap
page read and write
4F55000
heap
page read and write
6D080000
unkown
page readonly
4F4D000
heap
page read and write
4EA4000
heap
page read and write
4F65000
heap
page read and write
6D240000
unkown
page readonly
42FA000
heap
page read and write
4F4D000
heap
page read and write
4F59000
heap
page read and write
440F000
heap
page read and write
6E850000
unkown
page readonly
4F55000
heap
page read and write
8D0000
heap
page read and write
5730000
trusted library allocation
page read and write
4F90000
heap
page read and write
53C9000
heap
page read and write
54E6000
heap
page read and write
5A4E000
stack
page read and write
4FFD000
heap
page read and write
54C8000
heap
page read and write
4F67000
heap
page read and write
948000
heap
page read and write
4F51000
heap
page read and write
497E000
stack
page read and write
54C7000
heap
page read and write
43FB000
stack
page read and write
54C9000
heap
page read and write
800000
heap
page read and write
54C5000
heap
page read and write
4E41000
heap
page read and write
483E000
stack
page read and write
4F5B000
heap
page read and write
4F5C000
heap
page read and write
54CB000
heap
page read and write
5730000
trusted library allocation
page read and write
428E000
stack
page read and write
54CE000
heap
page read and write
948000
heap
page read and write
6D218000
unkown
page read and write
4F65000
heap
page read and write
97F000
heap
page read and write
54C1000
heap
page read and write
54E6000
heap
page read and write
1ACF000
unkown
page write copy
4F66000
heap
page read and write
4E43000
heap
page read and write
4F55000
heap
page read and write
54CA000
heap
page read and write
4F8C000
heap
page read and write
4E87000
heap
page read and write
4F8C000
heap
page read and write
4F54000
heap
page read and write
4F54000
heap
page read and write
5730000
trusted library allocation
page read and write
4D3E000
stack
page read and write
54C0000
heap
page read and write
4F4A000
heap
page read and write
4F53000
heap
page read and write
4F8C000
heap
page read and write
3FE5000
heap
page read and write
573E000
heap
page read and write
4E4B000
heap
page read and write
4E8B000
heap
page read and write
6D241000
unkown
page execute read
54CE000
heap
page read and write
26D8000
unkown
page write copy
4F5C000
heap
page read and write
4F62000
heap
page read and write
5730000
trusted library allocation
page read and write
5730000
trusted library allocation
page read and write
5730000
trusted library allocation
page read and write
4F4D000
heap
page read and write
4F54000
heap
page read and write
4F5C000
heap
page read and write
4F5C000
heap
page read and write
47FF000
stack
page read and write
4F63000
heap
page read and write
5C8E000
stack
page read and write
630000
heap
page read and write
24CF000
unkown
page read and write
4F62000
heap
page read and write
4EAA000
heap
page read and write
6D081000
unkown
page execute read
4F5B000
heap
page read and write
B70000
heap
page read and write
4169000
heap
page read and write
840000
heap
page read and write
4E3F000
stack
page read and write
42BE000
heap
page read and write
424E000
stack
page read and write
420E000
stack
page read and write
4F8C000
heap
page read and write
53C0000
heap
page read and write
493E000
stack
page read and write
4F5C000
heap
page read and write
4F67000
heap
page read and write
4CFD000
stack
page read and write
4F67000
heap
page read and write
54DD000
heap
page read and write
4FC3000
heap
page read and write
4F67000
heap
page read and write
5730000
trusted library allocation
page read and write
4F67000
heap
page read and write
There are 250 hidden memdumps, click here to show them.