IOC Report
SecuriteInfo.com.Win32.RATX-gen.24533.28061.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Win32.RATX-gen.24533.28061.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Windows\SysWOW64\Dtldt.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Windows\SysWOW64\Dtldt.exe:Zone.Identifier
ASCII text, with CRLF line terminators
modified
\Device\Null
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.24533.28061.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Win32.RATX-gen.24533.28061.exe"
 malicious
C:\Windows\SysWOW64\Dtldt.exe
C:\Windows\SysWOW64\Dtldt.exe -auto
 malicious
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\user\Desktop\SECURI~1.EXE > nul
 malicious
C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
206.238.196.240
malicious
https://ssl.ptlogin2.qq.com%s
unknown
http://www.appspeed.com/
unknown
http://www.appspeed.com/support
unknown
https://localhost.ptlogin2.qq.com:4301%sAccept-Language:
unknown
https://xui.ptlogin2.qq.com/cgi-bin/xlogin?appid=715030901&daid=73&hide_close_icon=1&pt_no_auth=1&s_
unknown
https://ssl.ptlogin2.qq.com%sAccept-Language:
unknown
http://ptlogin2.qun.qq.com%s
unknown
http://ptlogin2.qun.qq.com%sAccept-Language:
unknown
http://qun.qq.com%s
unknown
https://localhost.ptlogin2.qq.com:4301%s
unknown
http://qun.qq.com%sAccept-Language:
unknown
There are 2 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
127.0.0.1
unknown
unknown
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SYSTEM\Select
MarkTime

Memdumps

Base Address
Regiontype
Protect
Malicious
100F5000
trusted library allocation
page read and write
 malicious
51F000
unkown
page execute and read and write
 malicious
6D5000
unkown
page write copy
400000
unkown
page readonly
710000
heap
page read and write
2EF6000
trusted library allocation
page read and write
11C0000
heap
page execute and read and write
1C4A000
trusted library allocation
page read and write
5FE000
unkown
page execute and write copy
6D5000
unkown
page read and write
5DB000
unkown
page execute and write copy
30EF000
stack
page read and write
6D5000
unkown
page read and write
6D3000
unkown
page execute and read and write
50D000
unkown
page execute and read and write
2E80000
trusted library allocation
page execute and read and write
28FD000
trusted library allocation
page read and write
5D7000
unkown
page execute and read and write
1540000
trusted library allocation
page execute and read and write
4FD000
unkown
page execute and read and write
2E9E000
trusted library allocation
page execute and read and write
56B000
unkown
page execute and read and write
1AC2000
trusted library allocation
page execute and read and write
C8F000
stack
page read and write
DE0000
heap
page read and write
11DD000
heap
page execute and read and write
6D0000
unkown
page execute and write copy
731000
unkown
page readonly
57D000
unkown
page execute and read and write
1548000
trusted library allocation
page read and write
A78000
heap
page read and write
14BB000
heap
page execute and read and write
2E70000
trusted library allocation
page execute and read and write
1768000
heap
page execute and read and write
1AD6000
trusted library allocation
page execute and read and write
1691000
trusted library allocation
page read and write
10197000
trusted library allocation
page read and write
8B0000
heap
page read and write
57D000
unkown
page execute and read and write
1670000
trusted library allocation
page read and write
309E000
trusted library allocation
page read and write
1663000
trusted library allocation
page read and write
91E000
stack
page read and write
118D000
stack
page read and write
27F0000
heap
page read and write
2B2A000
heap
page execute and read and write
114E000
stack
page read and write
1AE6000
trusted library allocation
page execute and read and write
2FEE000
stack
page read and write
2A39000
trusted library allocation
page read and write
55F000
unkown
page execute and read and write
1ABE000
trusted library allocation
page execute and read and write
5F0000
unkown
page execute and write copy
1A3C000
trusted library allocation
page execute and read and write
1694000
trusted library allocation
page read and write
10001000
trusted library allocation
page execute read
5F8000
unkown
page execute and read and write
12F5000
heap
page read and write
D10000
heap
page execute and read and write
400000
unkown
page readonly
6D1000
unkown
page execute and write copy
1673000
trusted library allocation
page read and write
1B42000
trusted library allocation
page read and write
2A21000
trusted library allocation
page read and write
6D0000
unkown
page execute and write copy
6D6000
unkown
page write copy
138F000
heap
page execute and read and write
DBC000
heap
page read and write
731000
unkown
page readonly
127D000
heap
page execute and read and write
14B7000
heap
page execute and read and write
100C4000
trusted library allocation
page readonly
100E6000
trusted library allocation
page readonly
5F8000
unkown
page execute and read and write
5EF000
unkown
page execute and read and write
401000
unkown
page execute and read and write
85E000
stack
page read and write
2E6F000
heap
page read and write
166C000
trusted library allocation
page read and write
401000
unkown
page execute and write copy
CCE000
stack
page read and write
400000
unkown
page readonly
89E000
stack
page read and write
5D9000
unkown
page execute and read and write
2E00000
heap
page read and write
401000
unkown
page execute and read and write
2872000
heap
page execute and read and write
8AE000
stack
page read and write
129D000
heap
page execute and read and write
9C000
stack
page read and write
740000
heap
page read and write
2595000
heap
page read and write
11A7000
heap
page read and write
266B000
heap
page execute and read and write
2D0A000
heap
page execute and read and write
8D0000
heap
page read and write
31EF000
stack
page read and write
10193000
trusted library allocation
page readonly
1AB5000
trusted library allocation
page execute and read and write
9C000
stack
page read and write
D2A000
heap
page read and write
2EA1000
trusted library allocation
page execute and read and write
1948000
heap
page execute and read and write
5D9000
unkown
page execute and write copy
A70000
heap
page read and write
2A28000
trusted library allocation
page read and write
2DF7000
trusted library allocation
page execute and read and write
5DB000
unkown
page execute and write copy
267B000
heap
page execute and read and write
2FFD000
trusted library allocation
page read and write
2B23000
heap
page read and write
6D6000
unkown
page write copy
6D1000
unkown
page execute and write copy
C6F000
stack
page read and write
2B0C000
heap
page read and write
860000
heap
page read and write
6D5000
unkown
page write copy
1AE3000
trusted library allocation
page execute and read and write
B8E000
stack
page read and write
2AFD000
stack
page read and write
100B3000
trusted library allocation
page readonly
12AD000
heap
page execute and read and write
2A18000
trusted library allocation
page read and write
295D000
trusted library allocation
page execute and read and write
5EF000
unkown
page execute and read and write
28F8000
heap
page read and write
D0D000
stack
page read and write
19C000
stack
page read and write
124D000
heap
page execute and read and write
1684000
trusted library allocation
page read and write
5FE000
unkown
page execute and write copy
DE5000
heap
page read and write
400000
unkown
page readonly
A90000
heap
page read and write
401000
unkown
page execute and write copy
2B22000
heap
page read and write
998000
heap
page read and write
D59000
heap
page read and write
740000
heap
page read and write
261B000
heap
page execute and read and write
95E000
stack
page read and write
274A000
heap
page execute and read and write
690000
unkown
page execute and read and write
11D2000
heap
page read and write
2A49000
trusted library allocation
page read and write
26B8000
heap
page read and write
1543000
heap
page read and write
28F0000
trusted library allocation
page execute and read and write
6CD000
stack
page read and write
25AB000
heap
page execute and read and write
5D9000
unkown
page execute and read and write
8A0000
heap
page read and write
D20000
heap
page read and write
740000
heap
page read and write
2D50000
trusted library allocation
page execute and read and write
264B000
heap
page execute and read and write
D31000
heap
page read and write
1B4B000
trusted library allocation
page read and write
2E7D000
trusted library allocation
page execute and read and write
1C3E000
stack
page read and write
2E91000
trusted library allocation
page execute and read and write
2A46000
trusted library allocation
page read and write
731000
unkown
page readonly
2A25000
trusted library allocation
page read and write
E30000
heap
page read and write
1995000
trusted library allocation
page execute and read and write
2DCE000
unkown
page read and write
2AEF000
stack
page read and write
9B0000
heap
page read and write
2B00000
heap
page read and write
78E000
unkown
page read and write
173F000
stack
page read and write
5D7000
unkown
page execute and read and write
19D000
stack
page read and write
1AC5000
trusted library allocation
page execute and read and write
15AD000
trusted library allocation
page execute and read and write
2EF6000
trusted library allocation
page read and write
990000
heap
page read and write
690000
unkown
page execute and read and write
5F0000
unkown
page execute and write copy
1CF3000
trusted library allocation
page read and write
10000000
trusted library allocation
page read and write
5D9000
unkown
page execute and write copy
731000
unkown
page readonly
2876000
heap
page execute and read and write
100D4000
trusted library allocation
page readonly
1115000
heap
page read and write
There are 177 hidden memdumps, click here to show them.