Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
UtfPLaHG.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
\Device\ConDrv
|
ASCII text, with CRLF line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\UtfPLaHG.exe
|
"C:\Users\user\Desktop\UtfPLaHG.exe"
|
|
|
|
C:\Windows\SysWOW64\netsh.exe
|
netsh firewall add allowedprogram "C:\Users\user\Desktop\UtfPLaHG.exe" "UtfPLaHG.exe" ENABLE
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
asero23.ddns.net
|
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
asero23.ddns.net
|
178.128.228.252
|
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
178.128.228.252
|
asero23.ddns.net
|
Netherlands
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER
|
di
|
|
|
|
HKEY_CURRENT_USER\Environment
|
SEE_MASK_NOZONECHECKS
|
|
|
|
HKEY_CURRENT_USER\SOFTWARE\9128200b315d4a4c00056ef78bb90712
|
[kl]
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
C92000
|
unkown
|
page readonly
|
|
|
|
33E1000
|
trusted library allocation
|
page read and write
|
|
|
|
126C000
|
heap
|
page read and write
|
||
|
DB0000
|
heap
|
page read and write
|
||
|
10F6000
|
stack
|
page read and write
|
||
|
1400000
|
heap
|
page read and write
|
||
|
1235000
|
heap
|
page read and write
|
||
|
5570000
|
heap
|
page read and write
|
||
|
124D000
|
heap
|
page read and write
|
||
|
12D7000
|
heap
|
page read and write
|
||
|
1255000
|
heap
|
page read and write
|
||
|
1270000
|
heap
|
page read and write
|
||
|
12DC000
|
heap
|
page read and write
|
||
|
568E000
|
stack
|
page read and write
|
||
|
3479000
|
trusted library allocation
|
page read and write
|
||
|
1366000
|
trusted library allocation
|
page read and write
|
||
|
1134000
|
stack
|
page read and write
|
||
|
D29000
|
stack
|
page read and write
|
||
|
1265000
|
heap
|
page read and write
|
||
|
3840000
|
heap
|
page read and write
|
||
|
13B2000
|
trusted library allocation
|
page read and write
|
||
|
11B0000
|
heap
|
page read and write
|
||
|
578F000
|
stack
|
page read and write
|
||
|
125E000
|
heap
|
page read and write
|
||
|
13FE000
|
stack
|
page read and write
|
||
|
5814000
|
heap
|
page read and write
|
||
|
1372000
|
trusted library allocation
|
page execute and read and write
|
||
|
1239000
|
heap
|
page read and write
|
||
|
1485000
|
heap
|
page read and write
|
||
|
1235000
|
heap
|
page read and write
|
||
|
5814000
|
heap
|
page read and write
|
||
|
1291000
|
heap
|
page read and write
|
||
|
1201000
|
heap
|
page read and write
|
||
|
1225000
|
heap
|
page read and write
|
||
|
1250000
|
heap
|
page read and write
|
||
|
5210000
|
heap
|
page read and write
|
||
|
1265000
|
heap
|
page read and write
|
||
|
137A000
|
trusted library allocation
|
page execute and read and write
|
||
|
1750000
|
trusted library allocation
|
page execute and read and write
|
||
|
55F9000
|
stack
|
page read and write
|
||
|
1260000
|
heap
|
page read and write
|
||
|
1257000
|
heap
|
page read and write
|
||
|
126C000
|
heap
|
page read and write
|
||
|
125C000
|
heap
|
page read and write
|
||
|
1229000
|
heap
|
page read and write
|
||
|
11F4000
|
heap
|
page read and write
|
||
|
349D000
|
trusted library allocation
|
page read and write
|
||
|
12DA000
|
heap
|
page read and write
|
||
|
1267000
|
heap
|
page read and write
|
||
|
13B0000
|
trusted library allocation
|
page read and write
|
||
|
5806000
|
heap
|
page read and write
|
||
|
11F1000
|
heap
|
page read and write
|
||
|
16D0000
|
heap
|
page read and write
|
||
|
1230000
|
heap
|
page read and write
|
||
|
DA0000
|
heap
|
page read and write
|
||
|
112E000
|
stack
|
page read and write
|
||
|
4F50000
|
heap
|
page read and write
|
||
|
5816000
|
heap
|
page read and write
|
||
|
140E000
|
heap
|
page read and write
|
||
|
5814000
|
heap
|
page read and write
|
||
|
1254000
|
heap
|
page read and write
|
||
|
126A000
|
heap
|
page read and write
|
||
|
1980000
|
heap
|
page execute and read and write
|
||
|
122C000
|
heap
|
page read and write
|
||
|
124B000
|
heap
|
page read and write
|
||
|
1201000
|
heap
|
page read and write
|
||
|
123A000
|
heap
|
page read and write
|
||
|
1217000
|
heap
|
page read and write
|
||
|
54DE000
|
stack
|
page read and write
|
||
|
1225000
|
heap
|
page read and write
|
||
|
126E000
|
heap
|
page read and write
|
||
|
124E000
|
heap
|
page read and write
|
||
|
1473000
|
heap
|
page read and write
|
||
|
5817000
|
heap
|
page read and write
|
||
|
5814000
|
heap
|
page read and write
|
||
|
1260000
|
heap
|
page read and write
|
||
|
D90000
|
heap
|
page read and write
|
||
|
5814000
|
heap
|
page read and write
|
||
|
346F000
|
trusted library allocation
|
page read and write
|
||
|
1265000
|
heap
|
page read and write
|
||
|
13BB000
|
trusted library allocation
|
page execute and read and write
|
||
|
13A2000
|
trusted library allocation
|
page execute and read and write
|
||
|
1488000
|
heap
|
page read and write
|
||
|
103B000
|
stack
|
page read and write
|
||
|
5814000
|
heap
|
page read and write
|
||
|
1780000
|
heap
|
page read and write
|
||
|
131E000
|
stack
|
page read and write
|
||
|
122B000
|
heap
|
page read and write
|
||
|
1251000
|
heap
|
page read and write
|
||
|
11A0000
|
heap
|
page read and write
|
||
|
1239000
|
heap
|
page read and write
|
||
|
127B000
|
heap
|
page read and write
|
||
|
1233000
|
heap
|
page read and write
|
||
|
5800000
|
heap
|
page read and write
|
||
|
5802000
|
heap
|
page read and write
|
||
|
11C0000
|
heap
|
page read and write
|
||
|
123A000
|
heap
|
page read and write
|
||
|
126D000
|
heap
|
page read and write
|
||
|
1264000
|
heap
|
page read and write
|
||
|
57E0000
|
heap
|
page read and write
|
||
|
138C000
|
trusted library allocation
|
page execute and read and write
|
||
|
367E000
|
stack
|
page read and write
|
||
|
124D000
|
heap
|
page read and write
|
||
|
140A000
|
heap
|
page read and write
|
||
|
3830000
|
heap
|
page read and write
|
||
|
12D5000
|
heap
|
page read and write
|
||
|
126B000
|
heap
|
page read and write
|
||
|
125C000
|
heap
|
page read and write
|
||
|
135D000
|
stack
|
page read and write
|
||
|
5560000
|
trusted library allocation
|
page execute and read and write
|
||
|
122D000
|
heap
|
page read and write
|
||
|
128F000
|
heap
|
page read and write
|
||
|
3846000
|
heap
|
page read and write
|
||
|
126C000
|
heap
|
page read and write
|
||
|
1262000
|
heap
|
page read and write
|
||
|
55BC000
|
stack
|
page read and write
|
||
|
1233000
|
heap
|
page read and write
|
||
|
1237000
|
heap
|
page read and write
|
||
|
126B000
|
heap
|
page read and write
|
||
|
128F000
|
heap
|
page read and write
|
||
|
125C000
|
heap
|
page read and write
|
||
|
1215000
|
heap
|
page read and write
|
||
|
12D3000
|
heap
|
page read and write
|
||
|
1740000
|
trusted library allocation
|
page read and write
|
||
|
139A000
|
trusted library allocation
|
page execute and read and write
|
||
|
555B000
|
stack
|
page read and write
|
||
|
125F000
|
heap
|
page read and write
|
||
|
1365000
|
heap
|
page read and write
|
||
|
171E000
|
stack
|
page read and write
|
||
|
125C000
|
heap
|
page read and write
|
||
|
1210000
|
heap
|
page read and write
|
||
|
126B000
|
heap
|
page read and write
|
||
|
1290000
|
heap
|
page read and write
|
||
|
123A000
|
heap
|
page read and write
|
||
|
5000000
|
heap
|
page read and write
|
||
|
5817000
|
heap
|
page read and write
|
||
|
11E0000
|
heap
|
page read and write
|
||
|
1360000
|
trusted library allocation
|
page read and write
|
||
|
1239000
|
heap
|
page read and write
|
||
|
DFE000
|
stack
|
page read and write
|
||
|
1261000
|
heap
|
page read and write
|
||
|
124F000
|
heap
|
page read and write
|
||
|
1262000
|
heap
|
page read and write
|
||
|
1238000
|
heap
|
page read and write
|
||
|
1231000
|
heap
|
page read and write
|
||
|
12D8000
|
heap
|
page read and write
|
||
|
1265000
|
heap
|
page read and write
|
||
|
13B7000
|
trusted library allocation
|
page execute and read and write
|
||
|
1215000
|
heap
|
page read and write
|
||
|
11E8000
|
heap
|
page read and write
|
||
|
113B000
|
stack
|
page read and write
|
||
|
1235000
|
heap
|
page read and write
|
||
|
124B000
|
heap
|
page read and write
|
||
|
1251000
|
heap
|
page read and write
|
||
|
153E000
|
unkown
|
page read and write
|
||
|
1638000
|
trusted library allocation
|
page read and write
|
||
|
5815000
|
heap
|
page read and write
|
||
|
1261000
|
heap
|
page read and write
|
||
|
124F000
|
heap
|
page read and write
|
||
|
1480000
|
heap
|
page read and write
|
||
|
309F000
|
stack
|
page read and write
|
||
|
12D9000
|
heap
|
page read and write
|
||
|
5805000
|
heap
|
page read and write
|
||
|
1269000
|
heap
|
page read and write
|
||
|
128F000
|
heap
|
page read and write
|
||
|
1264000
|
heap
|
page read and write
|
||
|
1262000
|
heap
|
page read and write
|
||
|
138A000
|
trusted library allocation
|
page execute and read and write
|
||
|
1235000
|
heap
|
page read and write
|
||
|
1446000
|
heap
|
page read and write
|
||
|
1269000
|
heap
|
page read and write
|
||
|
5814000
|
heap
|
page read and write
|
||
|
1252000
|
heap
|
page read and write
|
||
|
1251000
|
heap
|
page read and write
|
||
|
124C000
|
heap
|
page read and write
|
||
|
551D000
|
stack
|
page read and write
|
||
|
113E000
|
stack
|
page read and write
|
||
|
131E000
|
unkown
|
page read and write
|
||
|
1252000
|
heap
|
page read and write
|
||
|
3455000
|
trusted library allocation
|
page read and write
|
||
|
127B000
|
heap
|
page read and write
|
||
|
125D000
|
heap
|
page read and write
|
||
|
12D2000
|
heap
|
page read and write
|
||
|
1360000
|
heap
|
page read and write
|
||
|
125E000
|
heap
|
page read and write
|
||
|
5814000
|
heap
|
page read and write
|
||
|
C90000
|
unkown
|
page readonly
|
||
|
122E000
|
heap
|
page read and write
|
||
|
13AA000
|
trusted library allocation
|
page execute and read and write
|
||
|
1229000
|
heap
|
page read and write
|
||
|
1225000
|
heap
|
page read and write
|
||
|
1266000
|
heap
|
page read and write
|
||
|
127B000
|
heap
|
page read and write
|
||
|
1770000
|
trusted library allocation
|
page read and write
|
||
|
126D000
|
heap
|
page read and write
|
||
|
1229000
|
heap
|
page read and write
|
||
|
1238000
|
heap
|
page read and write
|
||
|
57E1000
|
heap
|
page read and write
|
||
|
1201000
|
heap
|
page read and write
|
||
|
1227000
|
heap
|
page read and write
|
||
|
1256000
|
heap
|
page read and write
|
||
|
5660000
|
unclassified section
|
page read and write
|
||
|
12DE000
|
heap
|
page read and write
|
||
|
1290000
|
heap
|
page read and write
|
||
|
1970000
|
trusted library allocation
|
page read and write
|
||
|
1382000
|
trusted library allocation
|
page execute and read and write
|
||
|
1380000
|
trusted library allocation
|
page read and write
|
||
|
1252000
|
heap
|
page read and write
|
||
|
5801000
|
heap
|
page read and write
|
||
|
124F000
|
heap
|
page read and write
|
||
|
143F000
|
heap
|
page read and write
|
||
|
124E000
|
heap
|
page read and write
|
||
|
3431000
|
trusted library allocation
|
page read and write
|
||
|
1229000
|
heap
|
page read and write
|
||
|
1235000
|
heap
|
page read and write
|
||
|
128F000
|
heap
|
page read and write
|
||
|
126C000
|
heap
|
page read and write
|
||
|
1239000
|
heap
|
page read and write
|
||
|
1610000
|
heap
|
page read and write
|
||
|
43E1000
|
trusted library allocation
|
page read and write
|
||
|
12D4000
|
heap
|
page read and write
|
||
|
125C000
|
heap
|
page read and write
|
||
|
1236000
|
heap
|
page read and write
|
||
|
1397000
|
trusted library allocation
|
page execute and read and write
|
There are 214 hidden memdumps, click here to show them.