Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
SecuriteInfo.com.BScope.Trojan.Diple.31685.13945.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
|
C:\Users\user\Desktop\FalseUserPass.ini:SmartLogin.txt
|
ASCII text, with no line terminators
|
dropped
|
 |
|
|
C:\Users\user\AppData\Local\Temp\~DF7FC1D6B129264C8B.TMP
|
Composite Document File V2 Document, Cannot read section info
|
dropped
|
||
|
C:\Users\user\Desktop\FalseUserPass.ini.lock
|
ASCII text, with no line terminators
|
dropped
|
||
|
C:\Windows\FalseUserPass.ini
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Diple.31685.13945.exe
|
"C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Diple.31685.13945.exe"
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://www.startssl.com/sfsca.crt0
|
unknown
|
||
|
http://ocsp.startssl.com/sub/class2/code/ca0
|
unknown
|
||
|
http://aia.startssl.com/certs/sub.class2.code.ca.crt0#
|
unknown
|
||
|
http://crl.thawte.com/ThawteTimestampingCA.crl0
|
unknown
|
||
|
http://www.startssl.com/sfsca.crl0
|
unknown
|
||
|
http://www.startssl.com/policy.pdf04
|
unknown
|
||
|
http://blog.aloaha.com
|
unknown
|
||
|
http://ocsp.thawte.com0
|
unknown
|
||
|
http://crl.startssl.com/sfsca.crl0
|
unknown
|
||
|
http://www.startssl.com/policy.pdf0
|
unknown
|
||
|
http://www.startssl.com/intermediate.pdf0
|
unknown
|
||
|
http://www.aloaha.com/shop-en/aloaha-smart-login.php
|
unknown
|
||
|
http://www.aloaha.com/shop-en/aloaha-smart-login.php$Leaving
|
unknown
|
||
|
http://www.startssl.com/0
|
unknown
|
||
|
http://crl.startssl.com/crtc2-crl.crl0
|
unknown
|
||
|
http://www.aloaha.com/wi-software-en/uprade-your-aloaha-pdf-suite.php
|
unknown
|
||
|
http://www.aloaha.com/shop-en/aloaha-smart-login.phpslator.dll945.exe:2172
|
unknown
|
There are 7 hidden URLs, click here to show them.
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Aloaha
|
useini
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Aloaha
|
ctest
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Aloaha\pdf
|
alias
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Aloaha
|
debugpath
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Aloaha
|
atest
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Aloaha\pdf
|
commondir
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Aloaha\RKK
|
StandardHive
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Aloaha\RKK
|
LogonDomain
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Aloaha\RKK\Settings\Logon\Standard
|
LogonDomain
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Aloaha\CSP
|
AllowHID
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Aloaha\CSP
|
AllowHID
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Aloaha\CSP
|
ForceHID
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Aloaha\CSP
|
ForceHID
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
|
[119D030E-70FA-4F86-A944-ECAF4495A798]
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall
|
[119D030E-70FA-4F86-A944-ECAF4495A798]
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\SYSTEM
|
DisableChangePassword
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Aloaha\CSP
|
Permissions
|
||
|
HKEY_CURRENT_USER\SOFTWARE\Aloaha\CSP
|
Permissions
|
||
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Aloaha\GINA
|
MonitorCertOnly
|
There are 9 hidden registries, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7B1000
|
heap
|
page read and write
|
||
|
2260000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7BD000
|
heap
|
page read and write
|
||
|
22C0000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
469000
|
unkown
|
page execute read
|
||
|
7BD000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
401000
|
unkown
|
page execute read
|
||
|
720000
|
trusted library allocation
|
page execute read
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7BD000
|
heap
|
page read and write
|
||
|
7C2000
|
heap
|
page read and write
|
||
|
550000
|
unkown
|
page readonly
|
||
|
690000
|
heap
|
page read and write
|
||
|
739000
|
heap
|
page read and write
|
||
|
7C2000
|
heap
|
page read and write
|
||
|
74E000
|
heap
|
page read and write
|
||
|
9A000
|
stack
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
425000
|
unkown
|
page execute read
|
||
|
3120000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7C2000
|
heap
|
page read and write
|
||
|
7CD000
|
heap
|
page read and write
|
||
|
32CD000
|
stack
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7C2000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
469000
|
unkown
|
page execute read
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
840000
|
heap
|
page read and write
|
||
|
7C2000
|
heap
|
page read and write
|
||
|
2240000
|
heap
|
page read and write
|
||
|
550000
|
unkown
|
page readonly
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7C2000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7BD000
|
heap
|
page read and write
|
||
|
2D10000
|
heap
|
page read and write
|
||
|
763000
|
heap
|
page read and write
|
||
|
7C8000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
7C8000
|
heap
|
page read and write
|
||
|
54D000
|
unkown
|
page read and write
|
||
|
341E000
|
stack
|
page read and write
|
||
|
3140000
|
heap
|
page read and write
|
||
|
7C2000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7C7000
|
heap
|
page read and write
|
||
|
6B0000
|
heap
|
page read and write
|
||
|
6D6000
|
heap
|
page read and write
|
||
|
22D0000
|
trusted library allocation
|
page read and write
|
||
|
7C8000
|
heap
|
page read and write
|
||
|
7C1000
|
heap
|
page read and write
|
||
|
7BD000
|
heap
|
page read and write
|
||
|
22C5000
|
heap
|
page read and write
|
||
|
2A10000
|
heap
|
page read and write
|
||
|
7C8000
|
heap
|
page read and write
|
||
|
7C2000
|
heap
|
page read and write
|
||
|
2B78000
|
trusted library allocation
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7BC000
|
heap
|
page read and write
|
||
|
7BD000
|
heap
|
page read and write
|
||
|
318D000
|
stack
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7BD000
|
heap
|
page read and write
|
||
|
7C2000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
74A000
|
heap
|
page read and write
|
||
|
2D20000
|
trusted library section
|
page read and write
|
||
|
774000
|
heap
|
page read and write
|
||
|
7BD000
|
heap
|
page read and write
|
||
|
59A000
|
unkown
|
page readonly
|
||
|
740000
|
heap
|
page read and write
|
||
|
2B14000
|
heap
|
page read and write
|
||
|
7BD000
|
heap
|
page read and write
|
||
|
5AF000
|
unkown
|
page readonly
|
||
|
788000
|
heap
|
page read and write
|
||
|
328E000
|
stack
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
19C000
|
stack
|
page read and write
|
||
|
5AF000
|
unkown
|
page readonly
|
||
|
2B10000
|
heap
|
page read and write
|
||
|
7C8000
|
heap
|
page read and write
|
||
|
7C8000
|
heap
|
page read and write
|
||
|
2B33000
|
trusted library allocation
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
2B20000
|
trusted library allocation
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7C2000
|
heap
|
page read and write
|
||
|
425000
|
unkown
|
page execute read
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
59A000
|
unkown
|
page readonly
|
||
|
7C8000
|
heap
|
page read and write
|
||
|
730000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
6D0000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7BD000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
7B1000
|
heap
|
page read and write
|
||
|
850000
|
heap
|
page read and write
|
||
|
3310000
|
heap
|
page read and write
|
||
|
7C2000
|
heap
|
page read and write
|
||
|
7BD000
|
heap
|
page read and write
|
There are 106 hidden memdumps, click here to show them.