IOC Report
ZX7MDKtbfn.exe

loading gif

Files

File Path
Type
Category
Malicious
ZX7MDKtbfn.exe
PE32+ executable (GUI) x86-64, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\tkqesalfwllvk
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\e41a1be0
data
dropped
C:\Users\user\AppData\Roaming\NewFileTime\NewFileTime.ini
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\ZX7MDKtbfn.exe
"C:\Users\user\Desktop\ZX7MDKtbfn.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
C:\Windows\SysWOW64\cmd.exe
 malicious
C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://188.130.207.35/0b92e7ab19e861f9.php
malicious
http://www.vmware.com/0/
unknown
http://www.softwareok.comhttp://www.softwareok.deProgram
unknown
http://www.vmware.com/0
unknown
http://c0rl.m%L
unknown
http://www.symauth.com/cps0(
unknown
http://www.symauth.com/rpa00
unknown
http://crl3.digicert.
unknown
http://www.softwareok.de
unknown
http://www.softwareok.com
unknown
http://www.info-zip.org/
unknown
There are 1 hidden URLs, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
5910000
direct allocation
page read and write
 malicious
8C1000
unkown
page execute and write copy
 malicious
B30000
heap
page read and write
2D96000
trusted library allocation
page read and write
1A0000
heap
page read and write
2832000
heap
page read and write
5F6000
heap
page read and write
1FA0000
heap
page read and write
2043000
heap
page read and write
190000
heap
page read and write
55BE000
direct allocation
page read and write
14004F000
unkown
page read and write
30F4000
heap
page read and write
30F4000
heap
page read and write
1FD0000
heap
page read and write
57D1000
unkown
page read and write
5000000
trusted library allocation
page read and write
140038000
unkown
page readonly
33CF000
stack
page read and write
30F4000
heap
page read and write
554D000
direct allocation
page read and write
2E33000
unkown
page read and write
85C000
stack
page read and write
140001000
unkown
page execute read
2F50000
direct allocation
page read and write
29AA000
heap
page read and write
2621000
heap
page read and write
2F7B000
heap
page read and write
30F1000
unkown
page read and write
2630000
heap
page read and write
5420000
direct allocation
page read and write
4FD4000
heap
page read and write
30F4000
heap
page read and write
261F000
heap
page read and write
2DB6000
trusted library allocation
page read and write
5337000
trusted library allocation
page read and write
14006D000
unkown
page readonly
30F4000
heap
page read and write
140068000
unkown
page read and write
32CF000
unkown
page read and write
3410000
heap
page read and write
2B8C000
stack
page read and write
6C8000
heap
page read and write
527E000
direct allocation
page read and write
30F4000
heap
page read and write
30F0000
heap
page read and write
BC0000
heap
page read and write
32E0000
heap
page read and write
140000000
unkown
page readonly
3408000
heap
page read and write
2FAB000
unkown
page read and write
2BF0000
heap
page read and write
2DA2000
trusted library allocation
page read and write
3414000
heap
page read and write
7EF000
stack
page read and write
30AE000
stack
page read and write
2EFA000
stack
page read and write
30F4000
heap
page read and write
5FB000
heap
page read and write
6C3000
heap
page read and write
4DD0000
heap
page read and write
2F3E000
unkown
page read and write
2C30000
trusted library allocation
page read and write
50F7000
heap
page read and write
89D000
stack
page read and write
33E0000
heap
page read and write
2530000
heap
page read and write
2E27000
trusted library allocation
page read and write
3030000
unkown
page read and write
5549000
direct allocation
page read and write
140001000
unkown
page execute read
14010E000
unkown
page readonly
140045000
unkown
page write copy
520D000
direct allocation
page read and write
271D000
heap
page read and write
140044000
unkown
page write copy
5F0000
heap
page read and write
3414000
heap
page read and write
1D0000
heap
page read and write
140044000
unkown
page read and write
20F0000
heap
page read and write
140038000
unkown
page readonly
8DC000
unkown
page readonly
5CE000
stack
page read and write
2F40000
heap
page read and write
14006D000
unkown
page readonly
AF7000
unkown
page readonly
3400000
heap
page read and write
30F4000
heap
page read and write
3430000
unkown
page read and write
20F5000
heap
page read and write
5048000
trusted library allocation
page read and write
537F000
trusted library allocation
page read and write
57D1000
unkown
page read and write
1FB0000
heap
page read and write
5937000
direct allocation
page read and write
AFC000
unkown
page write copy
30F4000
heap
page read and write
50E0000
direct allocation
page read and write
14B000
stack
page read and write
3350000
heap
page read and write
57D0000
unkown
page read and write
1FA3000
heap
page read and write
4CAD000
heap
page read and write
681000
heap
page read and write
140000000
unkown
page readonly
30A8000
unkown
page read and write
2F70000
heap
page read and write
5209000
direct allocation
page read and write
8E4000
unkown
page write copy
CA0000
heap
page read and write
2040000
heap
page read and write
14010E000
unkown
page readonly
There are 103 hidden memdumps, click here to show them.