Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
SecuriteInfo.com.BackDoor.CmjSpy.326.14545.25032.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\is-K0O4V.tmp\SecuriteInfo.com.BackDoor.CmjSpy.326.14545.25032.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-V44NQ.tmp\_isetup\_RegDLL.tmp
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-V44NQ.tmp\_isetup\_setup64.tmp
|
PE32+ executable (console) x86-64, for MS Windows
|
dropped
|
||
|
C:\Users\user\AppData\Local\Temp\is-V44NQ.tmp\_isetup\_shfoldr.dll
|
PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.CmjSpy.326.14545.25032.exe
|
"C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.CmjSpy.326.14545.25032.exe"
|
|
|
|
C:\Users\user\AppData\Local\Temp\is-K0O4V.tmp\SecuriteInfo.com.BackDoor.CmjSpy.326.14545.25032.tmp
|
"C:\Users\user\AppData\Local\Temp\is-K0O4V.tmp\SecuriteInfo.com.BackDoor.CmjSpy.326.14545.25032.tmp" /SL5="$1043A,2318969,53248,C:\Users\user\Desktop\SecuriteInfo.com.BackDoor.CmjSpy.326.14545.25032.exe"
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://cyworld.nate.com/nuclear_mine
|
unknown
|
||
|
http://www.innosetup.com/
|
unknown
|
||
|
http://www.remobjects.com/?ps
|
unknown
|
||
|
http://ispp.sourceforge.net/
|
unknown
|
||
|
http://ispp.sourceforge.net/Des
|
unknown
|
||
|
http://www.remobjects.com/?psU
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
491000
|
unkown
|
page read and write
|
||
|
5CF000
|
heap
|
page read and write
|
||
|
2150000
|
heap
|
page read and write
|
||
|
4F0000
|
heap
|
page read and write
|
||
|
2770000
|
trusted library allocation
|
page read and write
|
||
|
494000
|
unkown
|
page write copy
|
||
|
401000
|
unkown
|
page execute read
|
||
|
580000
|
heap
|
page read and write
|
||
|
21B0000
|
direct allocation
|
page read and write
|
||
|
4A0E000
|
stack
|
page read and write
|
||
|
65A000
|
heap
|
page read and write
|
||
|
48AE000
|
stack
|
page read and write
|
||
|
338F000
|
stack
|
page read and write
|
||
|
30F0000
|
direct allocation
|
page read and write
|
||
|
2198000
|
direct allocation
|
page read and write
|
||
|
40D000
|
unkown
|
page write copy
|
||
|
21A6000
|
direct allocation
|
page read and write
|
||
|
420000
|
heap
|
page read and write
|
||
|
491000
|
unkown
|
page write copy
|
||
|
4C0000
|
heap
|
page read and write
|
||
|
2101000
|
direct allocation
|
page read and write
|
||
|
5AC000
|
heap
|
page read and write
|
||
|
328E000
|
stack
|
page read and write
|
||
|
2180000
|
heap
|
page read and write
|
||
|
2330000
|
heap
|
page read and write
|
||
|
324F000
|
stack
|
page read and write
|
||
|
20F0000
|
direct allocation
|
page read and write
|
||
|
4A2000
|
unkown
|
page readonly
|
||
|
21B0000
|
direct allocation
|
page read and write
|
||
|
650000
|
heap
|
page read and write
|
||
|
560000
|
heap
|
page read and write
|
||
|
19A000
|
stack
|
page read and write
|
||
|
5D0000
|
heap
|
page read and write
|
||
|
2334000
|
heap
|
page read and write
|
||
|
60B000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
20F4000
|
direct allocation
|
page read and write
|
||
|
30F0000
|
heap
|
page read and write
|
||
|
411000
|
unkown
|
page readonly
|
||
|
400000
|
unkown
|
page readonly
|
||
|
2189000
|
heap
|
page read and write
|
||
|
21BF000
|
direct allocation
|
page read and write
|
||
|
58A000
|
heap
|
page read and write
|
||
|
2360000
|
direct allocation
|
page read and write
|
||
|
9B000
|
stack
|
page read and write
|
||
|
2210000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
91000
|
stack
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
40B000
|
unkown
|
page read and write
|
||
|
2360000
|
direct allocation
|
page read and write
|
||
|
21A4000
|
direct allocation
|
page read and write
|
||
|
2185000
|
heap
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
19D000
|
stack
|
page read and write
|
||
|
2195000
|
direct allocation
|
page read and write
|
||
|
314E000
|
stack
|
page read and write
|
||
|
21D8000
|
direct allocation
|
page read and write
|
||
|
2101000
|
direct allocation
|
page read and write
|
||
|
40B000
|
unkown
|
page write copy
|
||
|
4C90000
|
trusted library allocation
|
page read and write
|
||
|
21BD000
|
direct allocation
|
page read and write
|
||
|
65E000
|
heap
|
page read and write
|
||
|
2160000
|
heap
|
page read and write
|
||
|
30F0000
|
direct allocation
|
page read and write
|
||
|
4B0F000
|
stack
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
566000
|
heap
|
page read and write
|
||
|
4A2000
|
unkown
|
page readonly
|
||
|
58E000
|
heap
|
page read and write
|
||
|
430000
|
heap
|
page read and write
|
||
|
411000
|
unkown
|
page readonly
|
||
|
26E0000
|
heap
|
page read and write
|
||
|
49AE000
|
stack
|
page read and write
|
||
|
2120000
|
direct allocation
|
page execute and read and write
|
||
|
21B0000
|
direct allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
4D0000
|
heap
|
page read and write
|
||
|
2108000
|
direct allocation
|
page read and write
|
||
|
2190000
|
direct allocation
|
page read and write
|
There are 70 hidden memdumps, click here to show them.