Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
RFQ-HL51L05.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\Charley
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut31DC.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\aut323A.tmp
|
data
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\ophiolatrous
|
ASCII text, with very long lines (28720), with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\RFQ-HL51L05.exe
|
"C:\Users\user\Desktop\RFQ-HL51L05.exe"
|
|
|
|
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
|
"C:\Users\user\Desktop\RFQ-HL51L05.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://r3.o.lencr.org0
|
unknown
|
||
|
http://r3.i.lencr.
|
unknown
|
||
|
https://account.dyn.com/
|
unknown
|
||
|
http://mail.cmcapama.top
|
unknown
|
||
|
http://x1.c.lencr.org/0
|
unknown
|
||
|
http://x1.i.lencr.org/0
|
unknown
|
||
|
http://cmcapama.top
|
unknown
|
||
|
http://r3.i.lencr.org/0
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
mail.cmcapama.top
|
unknown
|
|
|
|
cmcapama.top
|
194.36.191.196
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
194.36.191.196
|
cmcapama.top
|
Netherlands
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2CB8000
|
trusted library allocation
|
page read and write
|
|
|
|
2C41000
|
trusted library allocation
|
page read and write
|
|
|
|
2C8E000
|
trusted library allocation
|
page read and write
|
|
|
|
ED0000
|
direct allocation
|
page read and write
|
|
|
|
402000
|
system
|
page execute and read and write
|
|
|
|
F5A000
|
heap
|
page read and write
|
||
|
FB7000
|
heap
|
page read and write
|
||
|
2CB4000
|
trusted library allocation
|
page read and write
|
||
|
F20000
|
heap
|
page read and write
|
||
|
2C3E000
|
stack
|
page read and write
|
||
|
FB7000
|
heap
|
page read and write
|
||
|
2A0B000
|
trusted library allocation
|
page execute and read and write
|
||
|
F8C000
|
heap
|
page read and write
|
||
|
51D0000
|
trusted library allocation
|
page read and write
|
||
|
2AF0000
|
trusted library allocation
|
page read and write
|
||
|
F53000
|
heap
|
page read and write
|
||
|
38C3000
|
direct allocation
|
page read and write
|
||
|
29F2000
|
trusted library allocation
|
page read and write
|
||
|
3A6D000
|
direct allocation
|
page read and write
|
||
|
F7C000
|
heap
|
page read and write
|
||
|
37A0000
|
direct allocation
|
page read and write
|
||
|
3CA4000
|
trusted library allocation
|
page read and write
|
||
|
5720000
|
trusted library allocation
|
page read and write
|
||
|
4D3000
|
unkown
|
page write copy
|
||
|
E42000
|
heap
|
page read and write
|
||
|
D80000
|
heap
|
page read and write
|
||
|
410000
|
unkown
|
page readonly
|
||
|
5736000
|
trusted library allocation
|
page read and write
|
||
|
D97000
|
heap
|
page read and write
|
||
|
38C3000
|
direct allocation
|
page read and write
|
||
|
DE8000
|
heap
|
page read and write
|
||
|
51C0000
|
trusted library allocation
|
page read and write
|
||
|
F52000
|
heap
|
page read and write
|
||
|
3A69000
|
direct allocation
|
page read and write
|
||
|
37A0000
|
direct allocation
|
page read and write
|
||
|
FB7000
|
heap
|
page read and write
|
||
|
29D4000
|
trusted library allocation
|
page read and write
|
||
|
1058000
|
heap
|
page read and write
|
||
|
10C9000
|
heap
|
page read and write
|
||
|
2A40000
|
trusted library allocation
|
page read and write
|
||
|
49F000
|
unkown
|
page readonly
|
||
|
E4D000
|
heap
|
page read and write
|
||
|
10C4000
|
heap
|
page read and write
|
||
|
3A69000
|
direct allocation
|
page read and write
|
||
|
51E0000
|
heap
|
page execute and read and write
|
||
|
2A20000
|
trusted library allocation
|
page read and write
|
||
|
D68000
|
heap
|
page read and write
|
||
|
4CF000
|
unkown
|
page read and write
|
||
|
3A69000
|
direct allocation
|
page read and write
|
||
|
29ED000
|
trusted library allocation
|
page execute and read and write
|
||
|
38C3000
|
direct allocation
|
page read and write
|
||
|
5120000
|
trusted library allocation
|
page read and write
|
||
|
F85000
|
heap
|
page read and write
|
||
|
FB7000
|
heap
|
page read and write
|
||
|
51DC000
|
trusted library allocation
|
page read and write
|
||
|
5E7F000
|
stack
|
page read and write
|
||
|
2B1D000
|
trusted library allocation
|
page read and write
|
||
|
3A69000
|
direct allocation
|
page read and write
|
||
|
545E000
|
stack
|
page read and write
|
||
|
D50000
|
heap
|
page read and write
|
||
|
D40000
|
heap
|
page read and write
|
||
|
29C0000
|
trusted library allocation
|
page read and write
|
||
|
2B0A000
|
trusted library allocation
|
page read and write
|
||
|
6060000
|
trusted library allocation
|
page read and write
|
||
|
3450000
|
heap
|
page read and write
|
||
|
3A6D000
|
direct allocation
|
page read and write
|
||
|
D30000
|
heap
|
page read and write
|
||
|
631D000
|
stack
|
page read and write
|
||
|
BFD000
|
stack
|
page read and write
|
||
|
29F6000
|
trusted library allocation
|
page execute and read and write
|
||
|
1108000
|
heap
|
page read and write
|
||
|
3940000
|
direct allocation
|
page read and write
|
||
|
3A6D000
|
direct allocation
|
page read and write
|
||
|
2A50000
|
heap
|
page read and write
|
||
|
D60000
|
heap
|
page read and write
|
||
|
29DD000
|
trusted library allocation
|
page execute and read and write
|
||
|
171E000
|
stack
|
page read and write
|
||
|
4D8000
|
unkown
|
page readonly
|
||
|
5210000
|
heap
|
page read and write
|
||
|
3A69000
|
direct allocation
|
page read and write
|
||
|
29D3000
|
trusted library allocation
|
page execute and read and write
|
||
|
5213000
|
heap
|
page read and write
|
||
|
10D9000
|
heap
|
page read and write
|
||
|
CF9000
|
stack
|
page read and write
|
||
|
D95000
|
heap
|
page read and write
|
||
|
2A02000
|
trusted library allocation
|
page read and write
|
||
|
2CC1000
|
trusted library allocation
|
page read and write
|
||
|
3A69000
|
direct allocation
|
page read and write
|
||
|
F8C000
|
heap
|
page read and write
|
||
|
FB7000
|
heap
|
page read and write
|
||
|
4CF000
|
unkown
|
page write copy
|
||
|
10E8000
|
heap
|
page read and write
|
||
|
2B11000
|
trusted library allocation
|
page read and write
|
||
|
4D8000
|
unkown
|
page readonly
|
||
|
5CA000
|
stack
|
page read and write
|
||
|
37A0000
|
direct allocation
|
page read and write
|
||
|
3ADE000
|
direct allocation
|
page read and write
|
||
|
3C69000
|
trusted library allocation
|
page read and write
|
||
|
56DE000
|
stack
|
page read and write
|
||
|
3940000
|
direct allocation
|
page read and write
|
||
|
3ADE000
|
direct allocation
|
page read and write
|
||
|
F70000
|
heap
|
page read and write
|
||
|
685E000
|
stack
|
page read and write
|
||
|
37A0000
|
direct allocation
|
page read and write
|
||
|
29D0000
|
trusted library allocation
|
page read and write
|
||
|
9CA000
|
stack
|
page read and write
|
||
|
5730000
|
trusted library allocation
|
page read and write
|
||
|
2AFE000
|
trusted library allocation
|
page read and write
|
||
|
29E0000
|
trusted library allocation
|
page read and write
|
||
|
411000
|
unkown
|
page execute read
|
||
|
2B16000
|
trusted library allocation
|
page read and write
|
||
|
BBF000
|
stack
|
page read and write
|
||
|
3ADE000
|
direct allocation
|
page read and write
|
||
|
F5D000
|
heap
|
page read and write
|
||
|
C30000
|
heap
|
page read and write
|
||
|
3A6D000
|
direct allocation
|
page read and write
|
||
|
FD7000
|
heap
|
page read and write
|
||
|
578D000
|
stack
|
page read and write
|
||
|
110A000
|
heap
|
page read and write
|
||
|
3ADE000
|
direct allocation
|
page read and write
|
||
|
3C41000
|
trusted library allocation
|
page read and write
|
||
|
675E000
|
stack
|
page read and write
|
||
|
E3C000
|
heap
|
page read and write
|
||
|
E2F000
|
heap
|
page read and write
|
||
|
2A05000
|
trusted library allocation
|
page execute and read and write
|
||
|
4DA000
|
unkown
|
page readonly
|
||
|
FB7000
|
heap
|
page read and write
|
||
|
FB7000
|
heap
|
page read and write
|
||
|
518C000
|
stack
|
page read and write
|
||
|
2ADC000
|
stack
|
page read and write
|
||
|
4DA000
|
unkown
|
page readonly
|
||
|
DCE000
|
stack
|
page read and write
|
||
|
3940000
|
direct allocation
|
page read and write
|
||
|
D35000
|
heap
|
page read and write
|
||
|
FB7000
|
heap
|
page read and write
|
||
|
6890000
|
heap
|
page read and write
|
||
|
D4E000
|
stack
|
page read and write
|
||
|
60D0000
|
heap
|
page read and write
|
||
|
3940000
|
direct allocation
|
page read and write
|
||
|
410000
|
unkown
|
page readonly
|
||
|
DDC000
|
heap
|
page read and write
|
||
|
4C48000
|
trusted library allocation
|
page read and write
|
||
|
1043000
|
heap
|
page read and write
|
||
|
4E8000
|
unkown
|
page readonly
|
||
|
BDB000
|
stack
|
page read and write
|
||
|
6B00000
|
heap
|
page read and write
|
||
|
38C3000
|
direct allocation
|
page read and write
|
||
|
7F680000
|
trusted library allocation
|
page execute and read and write
|
||
|
F6C000
|
heap
|
page read and write
|
||
|
1015000
|
heap
|
page read and write
|
||
|
6050000
|
trusted library allocation
|
page execute and read and write
|
||
|
5220000
|
heap
|
page read and write
|
||
|
D7E000
|
heap
|
page read and write
|
||
|
600E000
|
stack
|
page read and write
|
||
|
555E000
|
stack
|
page read and write
|
||
|
2A00000
|
trusted library allocation
|
page read and write
|
||
|
400000
|
system
|
page execute and read and write
|
||
|
F7C000
|
heap
|
page read and write
|
||
|
EB0000
|
direct allocation
|
page execute and read and write
|
||
|
3940000
|
direct allocation
|
page read and write
|
||
|
5130000
|
trusted library allocation
|
page read and write
|
||
|
2A07000
|
trusted library allocation
|
page execute and read and write
|
||
|
49F000
|
unkown
|
page readonly
|
||
|
F52000
|
heap
|
page read and write
|
||
|
BCF000
|
stack
|
page read and write
|
||
|
1B1E000
|
stack
|
page read and write
|
||
|
51C8000
|
trusted library allocation
|
page read and write
|
||
|
4C5000
|
unkown
|
page readonly
|
||
|
10D8000
|
heap
|
page read and write
|
||
|
411000
|
unkown
|
page execute read
|
||
|
10C9000
|
heap
|
page read and write
|
||
|
2AE0000
|
trusted library allocation
|
page read and write
|
||
|
3A6D000
|
direct allocation
|
page read and write
|
||
|
57CE000
|
stack
|
page read and write
|
||
|
F5D000
|
heap
|
page read and write
|
||
|
2B0E000
|
trusted library allocation
|
page read and write
|
||
|
3454000
|
heap
|
page read and write
|
||
|
FD0000
|
heap
|
page read and write
|
||
|
5740000
|
trusted library allocation
|
page execute and read and write
|
||
|
10E8000
|
heap
|
page read and write
|
||
|
4DDD000
|
stack
|
page read and write
|
||
|
29F0000
|
trusted library allocation
|
page read and write
|
||
|
6080000
|
heap
|
page read and write
|
||
|
6070000
|
trusted library allocation
|
page read and write
|
||
|
EC0000
|
heap
|
page read and write
|
||
|
F28000
|
heap
|
page read and write
|
||
|
68A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
569E000
|
stack
|
page read and write
|
||
|
3940000
|
direct allocation
|
page read and write
|
||
|
E90000
|
heap
|
page read and write
|
||
|
FB7000
|
heap
|
page read and write
|
||
|
38C3000
|
direct allocation
|
page read and write
|
||
|
2B02000
|
trusted library allocation
|
page read and write
|
||
|
110B000
|
heap
|
page read and write
|
||
|
F43000
|
heap
|
page read and write
|
||
|
37A0000
|
direct allocation
|
page read and write
|
||
|
2AFB000
|
trusted library allocation
|
page read and write
|
||
|
559E000
|
stack
|
page read and write
|
||
|
10E9000
|
heap
|
page read and write
|
||
|
3A6D000
|
direct allocation
|
page read and write
|
||
|
3ADE000
|
direct allocation
|
page read and write
|
||
|
4E8000
|
unkown
|
page readonly
|
||
|
FB8000
|
heap
|
page read and write
|
||
|
2A30000
|
trusted library allocation
|
page execute and read and write
|
||
|
29FA000
|
trusted library allocation
|
page execute and read and write
|
||
|
38C3000
|
direct allocation
|
page read and write
|
||
|
609E000
|
heap
|
page read and write
|
||
|
3ADE000
|
direct allocation
|
page read and write
|
||
|
DF9000
|
heap
|
page read and write
|
||
|
37A0000
|
direct allocation
|
page read and write
|
||
|
2A9E000
|
stack
|
page read and write
|
||
|
D8A000
|
heap
|
page read and write
|
||
|
D50000
|
heap
|
page read and write
|
||
|
2C8C000
|
trusted library allocation
|
page read and write
|
||
|
541C000
|
stack
|
page read and write
|
||
|
6860000
|
trusted library allocation
|
page read and write
|
||
|
2980000
|
heap
|
page read and write
|
||
|
4C5000
|
unkown
|
page readonly
|
||
|
F6C000
|
heap
|
page read and write
|
||
|
2CA7000
|
trusted library allocation
|
page read and write
|
||
|
2B30000
|
heap
|
page execute and read and write
|
||
|
6067000
|
trusted library allocation
|
page read and write
|
There are 212 hidden memdumps, click here to show them.