IOC Report
UC2DFXQIBiE2kQ.dll

loading gif

Files

File Path
Type
Category
Malicious
UC2DFXQIBiE2kQ.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, Windows 2000/XP setup, 62919 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
modified

Processes

Path
Cmdline
Malicious
C:\Windows\System32\regsvr32.exe
regsvr32.exe /s C:\Users\user\Desktop\UC2DFXQIBiE2kQ.dll
 malicious
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\UC2DFXQIBiE2kQ.dll",#1
 malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\UC2DFXQIBiE2kQ.dll,ACeujVZMknFDjv
 malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\UC2DFXQIBiE2kQ.dll,AHuDGMflBfPryOEYjuTfbzJdEM
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Windows\system32\NzmNpNPvo\tzEWj.dll"
 malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\UC2DFXQIBiE2kQ.dll,ATjQPkInxPUGuUu
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\system32\regsvr32.exe" "C:\Windows\system32\NzmNpNPvo\tzEWj.dll
 malicious
C:\Windows\System32\regsvr32.exe
C:\Windows\system32\regsvr32.exe "C:\Users\user\AppData\Local\VfjAKsbRVDLoO\aeuwPIzDFvIwK.dll"
 malicious
C:\Windows\System32\loaddll64.exe
loaddll64.exe "C:\Users\user\Desktop\UC2DFXQIBiE2kQ.dll"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\cmd.exe
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\UC2DFXQIBiE2kQ.dll",#1
There are 1 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://172.105.115.71:8080/
unknown

IPs

IP
Domain
Country
Malicious
172.105.115.71
unknown
United States
malicious
188.165.79.151
unknown
France
malicious
196.44.98.190
unknown
Ghana
malicious
174.138.33.49
unknown
United States
malicious
36.67.23.59
unknown
Indonesia
malicious
103.41.204.169
unknown
Indonesia
malicious
85.214.67.203
unknown
Germany
malicious
83.229.80.93
unknown
United Kingdom
malicious
198.199.70.22
unknown
United States
malicious
93.104.209.107
unknown
Germany
malicious
186.250.48.5
unknown
Brazil
malicious
209.239.112.82
unknown
United States
malicious
175.126.176.79
unknown
Korea Republic of
malicious
128.199.242.164
unknown
United Kingdom
malicious
178.238.225.252
unknown
Germany
malicious
46.101.98.60
unknown
Netherlands
malicious
190.145.8.4
unknown
Colombia
malicious
82.98.180.154
unknown
Spain
malicious
103.71.99.57
unknown
India
malicious
87.106.97.83
unknown
Germany
malicious
103.254.12.236
unknown
Viet Nam
malicious
103.85.95.4
unknown
Indonesia
malicious
202.134.4.210
unknown
Indonesia
malicious
165.22.254.236
unknown
United States
malicious
78.47.204.80
unknown
Germany
malicious
118.98.72.86
unknown
Indonesia
malicious
139.59.80.108
unknown
Singapore
malicious
104.244.79.94
unknown
United States
malicious
37.44.244.177
unknown
Germany
malicious
51.75.33.122
unknown
France
malicious
160.16.143.191
unknown
Japan
malicious
103.56.149.105
unknown
Indonesia
malicious
85.25.120.45
unknown
Germany
malicious
139.196.72.155
unknown
China
malicious
115.178.55.22
unknown
Indonesia
malicious
103.126.216.86
unknown
Bangladesh
malicious
128.199.217.206
unknown
United Kingdom
malicious
114.79.130.68
unknown
India
malicious
103.224.241.74
unknown
India
malicious
210.57.209.142
unknown
Indonesia
malicious
202.28.34.99
unknown
Thailand
malicious
80.211.107.116
unknown
Italy
malicious
54.37.228.122
unknown
France
malicious
218.38.121.17
unknown
Korea Republic of
malicious
185.148.169.10
unknown
Germany
malicious
195.77.239.39
unknown
Spain
malicious
178.62.112.199
unknown
European Union
malicious
62.171.178.147
unknown
United Kingdom
malicious
64.227.55.231
unknown
United States
malicious
There are 39 hidden IPs, click here to show them.

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
tzEWj.dll
 malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
2A2C5F01000
direct allocation
page execute read
 malicious
1EEA9950000
direct allocation
page execute and read and write
 malicious
1350000
direct allocation
page execute and read and write
 malicious
4D0000
direct allocation
page execute and read and write
 malicious
2A2C4510000
direct allocation
page execute and read and write
 malicious
1E000100000
direct allocation
page execute and read and write
 malicious
731000
direct allocation
page execute read
 malicious
C90000
direct allocation
page execute and read and write
 malicious
1E000141000
direct allocation
page execute read
 malicious
2C41000
direct allocation
page execute read
 malicious
2731000
direct allocation
page execute read
 malicious
1EEA9991000
direct allocation
page execute read
 malicious
7DE000
stack
page read and write
1EEA99F1000
heap
page read and write
11DB000
heap
page read and write
1187000
heap
page read and write
1EEA9990000
direct allocation
page read and write
11A4000
heap
page read and write
ACF6EFF000
stack
page read and write
2055000
heap
page read and write
1239BB50000
heap
page read and write
2580000
remote allocation
page read and write
CC8000
heap
page read and write
2C6B000
direct allocation
page readonly
18009B000
unkown
page readonly
29A0000
trusted library allocation
page read and write
648000
heap
page read and write
1EEA99BD000
direct allocation
page readonly
18004C000
unkown
page readonly
1239B8AD000
heap
page read and write
2970000
heap
page read and write
1120000
heap
page read and write
623000
heap
page read and write
1EEA9A2B000
heap
page read and write
C70000
direct allocation
page execute and read and write
1EEA9BC5000
heap
page read and write
2A2C457E000
heap
page read and write
2A2C4550000
heap
page readonly
2053000
heap
page read and write
27FE000
stack
page read and write
5FE000
heap
page read and write
2749000
heap
page read and write
1EEA9A39000
heap
page read and write
63C000
heap
page read and write
180000
remote allocation
page read and write
617000
heap
page read and write
1EEA99DE000
heap
page read and write
275D000
direct allocation
page readonly
11AF000
heap
page read and write
61D000
heap
page read and write
DCE000
heap
page read and write
ACF6BDC000
stack
page read and write
635000
heap
page read and write
1EEA9A3C000
heap
page read and write
1187000
heap
page read and write
2A2C45C9000
heap
page read and write
2E2F000
stack
page read and write
609000
heap
page read and write
930000
remote allocation
page read and write
730000
direct allocation
page read and write
190000
heap
page read and write
1239EBD3000
heap
page read and write
D18000
heap
page read and write
1EEA9A5C000
heap
page read and write
6AE000
heap
page read and write
2C80000
trusted library allocation
page read and write
1EEA9A42000
heap
page read and write
2C40000
direct allocation
page read and write
2D7E000
stack
page read and write
D2201AF000
stack
page read and write
1EEA9900000
heap
page read and write
2069000
heap
page read and write
2054000
heap
page read and write
CED000
heap
page read and write
2460000
trusted library allocation
page read and write
180000000
unkown
page readonly
D39000
heap
page read and write
275B000
direct allocation
page readonly
605000
heap
page read and write
1187000
heap
page read and write
7F0000
heap
page read and write
180000000
unkown
page readonly
629000
heap
page read and write
2A2C5F2B000
direct allocation
page readonly
1380000
heap
page read and write
1E07E6AE000
heap
page read and write
15B000
stack
page read and write
940000
heap
page read and write
1239EBE0000
trusted library allocation
page read and write
1EEA9A2B000
heap
page read and write
2A2C45B8000
heap
page read and write
1EEA9980000
direct allocation
page execute and read and write
1239B990000
heap
page read and write
5F8000
heap
page read and write
1E000140000
direct allocation
page read and write
2730000
direct allocation
page read and write
1195000
heap
page read and write
1198000
heap
page read and write
116C000
heap
page read and write
1FCC000
heap
page read and write
18004C000
unkown
page readonly
5EB000
heap
page read and write
C20000
heap
page read and write
1EEA9A2B000
heap
page read and write
2A2C44B0000
heap
page read and write
61D000
heap
page read and write
7F5000
heap
page read and write
DF2000
heap
page read and write
2C6C000
direct allocation
page read and write
2580000
remote allocation
page read and write
5EF000
heap
page read and write
CED000
heap
page read and write
D80000
heap
page read and write
1E000350000
heap
page read and write
1128000
heap
page read and write
180000
remote allocation
page read and write
117B000
heap
page read and write
180000000
unkown
page readonly
75D000
direct allocation
page readonly
2A2C4540000
direct allocation
page execute and read and write
1BD8FBF000
stack
page read and write
1E00002C000
heap
page read and write
11B8000
heap
page read and write
D4E000
stack
page read and write
2721000
heap
page read and write
20F801C5000
heap
page read and write
2A2C458E000
heap
page read and write
6AE000
heap
page read and write
6AD000
heap
page read and write
10E0000
heap
page read and write
1239B87E000
heap
page read and write
20F80000000
heap
page read and write
617000
heap
page read and write
20F800E0000
heap
page read and write
1E07E69E000
heap
page read and write
DDB000
stack
page read and write
909000
stack
page read and write
CED000
heap
page read and write
26AF000
stack
page read and write
2DF7000
stack
page read and write
DD6000
heap
page read and write
61D000
heap
page read and write
C00000
heap
page read and write
275C000
direct allocation
page read and write
2A2C5E00000
heap
page read and write
DC1000
heap
page read and write
75B000
direct allocation
page readonly
1E07E850000
heap
page read and write
2A2C45B8000
heap
page read and write
1187000
heap
page read and write
205B000
heap
page read and write
1239B88D000
heap
page read and write
98C000
heap
page read and write
180098000
unkown
page read and write
1239BB30000
heap
page read and write
119D000
heap
page read and write
C85000
heap
page read and write
1E07E4D0000
heap
page read and write
5FC000
heap
page read and write
635000
heap
page read and write
1EEA9A4A000
heap
page read and write
1E07E855000
heap
page read and write
D27000
heap
page read and write
5DF000
heap
page read and write
1BD8F3F000
stack
page read and write
2460000
trusted library allocation
page read and write
2D5C000
stack
page read and write
206B000
heap
page read and write
2769000
heap
page read and write
930000
remote allocation
page read and write
1E07E69E000
heap
page read and write
7E0000
trusted library allocation
page read and write
5DD000
heap
page read and write
2054000
heap
page read and write
6AE000
heap
page read and write
55094C000
stack
page read and write
980000
heap
page read and write
1E07E688000
heap
page read and write
1EEA9BC0000
heap
page read and write
255C000
stack
page read and write
1239B886000
heap
page read and write
2997000
stack
page read and write
1E07E6D8000
heap
page read and write
1EEA9A48000
heap
page read and write
5B0000
heap
page read and write
2053000
heap
page read and write
5960000
trusted library allocation
page read and write
2A2C457E000
heap
page read and write
2069000
heap
page read and write
DA0000
heap
page read and write
1EEA98E0000
heap
page read and write
1E07E69E000
heap
page read and write
2A2C4560000
heap
page read and write
ACF6F7F000
stack
page read and write
1FA0000
heap
page read and write
1E07E680000
heap
page read and write
2810000
heap
page read and write
CC0000
heap
page read and write
1EEA99C0000
heap
page readonly
272E000
stack
page read and write
28BF000
heap
page read and write
5EB000
heap
page read and write
1EEA9A2B000
heap
page read and write
18009B000
unkown
page readonly
31BE000
stack
page read and write
ACF6E7E000
stack
page read and write
D2200AC000
stack
page read and write
15E04FD000
stack
page read and write
2EAC000
stack
page read and write
2B30000
heap
page read and write
D0C000
heap
page read and write
1E07E6D8000
heap
page read and write
211B000
stack
page read and write
1EEA9A4A000
heap
page read and write
520000
heap
page read and write
623000
heap
page read and write
1EEA9A7F000
heap
page read and write
1EEAB610000
heap
page read and write
DA8000
heap
page read and write
60F000
heap
page read and write
2769000
heap
page read and write
1239B889000
heap
page read and write
6AE000
heap
page read and write
69D000
heap
page read and write
1E07E6E9000
heap
page read and write
1187000
heap
page read and write
2820000
heap
page read and write
1EEAB39C000
heap
page read and write
69D000
heap
page read and write
2A2C4490000
heap
page read and write
2069000
heap
page read and write
1239B892000
heap
page read and write
1239B88E000
heap
page read and write
32BB000
stack
page read and write
985000
heap
page read and write
180098000
unkown
page read and write
5DD000
heap
page read and write
11A6000
heap
page read and write
A0000
heap
page read and write
1EEA97A0000
heap
page read and write
1E000170000
heap
page readonly
2000000
heap
page read and write
1EEA9A6D000
heap
page read and write
1385000
heap
page read and write
1239B889000
heap
page read and write
61D000
heap
page read and write
1EEA9A53000
heap
page read and write
1FD9000
heap
page read and write
5509CF000
stack
page read and write
510000
heap
page readonly
608000
heap
page read and write
5FE000
heap
page read and write
1239B877000
heap
page read and write
DCA000
heap
page read and write
623000
heap
page read and write
11A6000
heap
page read and write
2055000
heap
page read and write
180098000
unkown
page read and write
60F000
heap
page read and write
20F801B8000
heap
page read and write
24DC000
stack
page read and write
5FE000
heap
page read and write
2A2C5F00000
direct allocation
page read and write
D22012F000
stack
page read and write
1B0000
heap
page read and write
2A2C44F5000
heap
page read and write
2A2C5E2C000
heap
page read and write
635000
heap
page read and write
1239EA90000
heap
page read and write
960000
heap
page read and write
5EF000
heap
page read and write
D20000
heap
page read and write
CFE000
heap
page read and write
2C30000
direct allocation
page execute and read and write
75C000
direct allocation
page read and write
1239B8B5000
heap
page read and write
2A2C44F0000
heap
page read and write
DF2000
heap
page read and write
5F7000
heap
page read and write
2A2C5F50000
heap
page read and write
647000
heap
page read and write
1239B89C000
heap
page read and write
60F000
heap
page read and write
2580000
remote allocation
page read and write
26AF000
stack
page read and write
114E000
heap
page read and write
2069000
heap
page read and write
2021000
heap
page read and write
2C70000
heap
page readonly
1EEA99D0000
heap
page read and write
C80000
heap
page read and write
1E00016B000
direct allocation
page readonly
180001000
unkown
page execute read
69D000
heap
page read and write
1EEAB370000
heap
page read and write
2120000
trusted library allocation
page read and write
2A2C457E000
heap
page read and write
DCE000
heap
page read and write
1E000130000
direct allocation
page execute and read and write
5DD000
heap
page read and write
2048000
heap
page read and write
2748000
heap
page read and write
2A2C4350000
heap
page read and write
2C80000
trusted library allocation
page read and write
1EEA9A2B000
heap
page read and write
DC6000
heap
page read and write
1239EBD0000
heap
page read and write
DF2000
heap
page read and write
1239B720000
heap
page read and write
1239BB5B000
heap
page read and write
2760000
heap
page readonly
1BD8EBB000
stack
page read and write
550C7F000
stack
page read and write
1E00016D000
direct allocation
page readonly
69D000
heap
page read and write
69D000
heap
page read and write
2A2C4567000
heap
page read and write
12CF000
stack
page read and write
9CB000
stack
page read and write
D27000
heap
page read and write
1E07E630000
heap
page read and write
1E07E610000
heap
page read and write
26B0000
heap
page read and write
1239B870000
heap
page read and write
D83000
heap
page read and write
11C9000
heap
page read and write
5FA000
heap
page read and write
910000
heap
page read and write
1239B8A1000
heap
page read and write
323E000
stack
page read and write
1100000
heap
page read and write
DCE000
heap
page read and write
DDD000
heap
page read and write
5F7000
heap
page read and write
6AE000
heap
page read and write
CFB000
heap
page read and write
180001000
unkown
page execute read
1239B898000
heap
page read and write
2CF0000
heap
page read and write
2048000
heap
page read and write
1EEA99BB000
direct allocation
page readonly
134F000
stack
page read and write
850000
heap
page read and write
6AA000
heap
page read and write
D50000
heap
page read and write
2062000
heap
page read and write
1E000000000
heap
page read and write
1239B89C000
heap
page read and write
27ED000
stack
page read and write
CF2000
heap
page read and write
2721000
heap
page read and write
261D000
stack
page read and write
18004C000
unkown
page readonly
69D000
heap
page read and write
1239BB55000
heap
page read and write
1239B892000
heap
page read and write
1239B970000
heap
page read and write
2C6D000
direct allocation
page readonly
20F801B0000
heap
page read and write
623000
heap
page read and write
180001000
unkown
page execute read
11B8000
heap
page read and write
69A000
heap
page read and write
284C000
heap
page read and write
2A2C5F2D000
direct allocation
page readonly
DF2000
heap
page read and write
500000
direct allocation
page execute and read and write
1187000
heap
page read and write
27F0000
trusted library allocation
page read and write
5B8000
heap
page read and write
2053000
heap
page read and write
18009B000
unkown
page readonly
There are 362 hidden memdumps, click here to show them.