IOC Report
Updater.dll.exe

loading gif

Files

File Path
Type
Category
Malicious
Updater.dll.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
initial sample
 malicious
C:\ProgramData\SnapMobile\Updater.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\ProgramData\SnapMobile\Updater.dll:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Spiralogics\Updater.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\ProgramData\Spiralogics\Updater.dll:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Talespin\Updater.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\ProgramData\Talespin\Updater.dll:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Ventuso LLC\Updater.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\ProgramData\Ventuso LLC\Updater.dll:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Windows\Tasks\SnapMobile.job
data
modified
C:\Windows\Tasks\Spiralogics.job
data
modified
C:\Windows\Tasks\Talespin.job
data
modified
C:\Windows\Tasks\Ventuso LLC.job
data
modified
There are 3 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\Updater.dll.dll,DllGetClassObject
 malicious
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\Updater.dll.dll",#1
 malicious
C:\Windows\System32\rundll32.exe
C:\Windows\system32\rundll32.exe "C:\ProgramData\Talespin\Updater.dll",Start /u
 malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\Updater.dll.dll,DllRegisterServer
 malicious
C:\Windows\System32\rundll32.exe
C:\Windows\system32\rundll32.exe "C:\ProgramData\Ventuso LLC\Updater.dll",Start /u
 malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\Updater.dll.dll,DllRegisterServerEx
 malicious
C:\Windows\System32\rundll32.exe
C:\Windows\system32\rundll32.exe "C:\ProgramData\SnapMobile\Updater.dll",Start /u
 malicious
C:\Windows\System32\rundll32.exe
C:\Windows\system32\rundll32.exe "C:\ProgramData\Spiralogics\Updater.dll",Start /u
 malicious
C:\Windows\System32\rundll32.exe
C:\Windows\system32\rundll32.exe "C:\ProgramData\Spiralogics\Updater.dll",Start /u
 malicious
C:\Windows\System32\loaddll64.exe
loaddll64.exe "C:\Users\user\Desktop\Updater.dll.dll"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\cmd.exe
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Updater.dll.dll",#1
C:\Windows\System32\regsvr32.exe
regsvr32.exe /s C:\Users\user\Desktop\Updater.dll.dll
There are 3 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://185.161.251.26/LMEM
unknown
https://185.161.251.26/(
unknown
https://185.161.251.26/nd
unknown
https://185.161.251.26/k
unknown
https://185.161.251.26/161.251.26/
unknown
https://185.161.251.26/o
unknown
https://185.161.251.26/0
unknown
https://185.161.251.26/0J#DQ
unknown
https://185.161.251.26/s
unknown
https://185.161.251.26/r
unknown
https://185.161.251.26/5
unknown
https://185.161.251.26/viderw
unknown
https://185.161.251.26/PW#DQ
unknown
https://185.161.251.26/7
unknown
https://185.161.251.26/w
unknown
https://185.161.251.26/gits
unknown
https://185.161.251.26/;~
unknown
https://185.161.251.26/aenh.dll(DQ
unknown
https://185.161.251.26/
unknown
https://185.161.251.26/aenh.dll
unknown
https://185.161.251.26/viderG
unknown
https://185.161.251.26/G
unknown
https://185.161.251.26/K
unknown
https://185.161.251.26/vider
unknown
https://185.161.251.26/nh.dllD
unknown
https://185.161.251.26/L
unknown
https://185.161.251.26/P
unknown
https://185.161.251.26/ography
unknown
https://185.161.251.26/T
unknown
https://185.161.251.26/viderY
unknown
https://185.161.251.26/Y
unknown
https://185.161.251.26/0Y#DQ
unknown
There are 22 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
171.39.242.20.in-addr.arpa
unknown

IPs

IP
Domain
Country
Malicious
185.161.251.26
unknown
United Kingdom
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob

Memdumps

Base Address
Regiontype
Protect
Malicious
15144279000
heap
page read and write
15144279000
heap
page read and write
21C49D90000
heap
page read and write
15144235000
heap
page read and write
9C0000
heap
page read and write
1514426C000
heap
page read and write
1514426C000
heap
page read and write
15144269000
heap
page read and write
15144269000
heap
page read and write
D30000
heap
page read and write
15144266000
heap
page read and write
232BEC000
stack
page read and write
151441ED000
heap
page read and write
1718B530000
heap
page read and write
1718B57F000
heap
page read and write
1514423E000
heap
page read and write
21C49B7B000
heap
page read and write
15144266000
heap
page read and write
15144279000
heap
page read and write
15144242000
heap
page read and write
15144269000
heap
page read and write
15144241000
heap
page read and write
15144241000
heap
page read and write
1718B800000
heap
page read and write
15144040000
heap
page read and write
15144269000
heap
page read and write
21C49B8B000
heap
page read and write
15144269000
heap
page read and write
15144242000
heap
page read and write
1514426C000
heap
page read and write
1514419D000
heap
page read and write
15144279000
heap
page read and write
F0CE87C000
stack
page read and write
15144266000
heap
page read and write
1E0139E0000
heap
page read and write
15144B4F000
heap
page read and write
21C49B90000
heap
page read and write
15144269000
heap
page read and write
15144279000
heap
page read and write
15144B4F000
heap
page read and write
224DB400000
heap
page read and write
15144266000
heap
page read and write
913476C000
stack
page read and write
13C354A0000
heap
page read and write
15144140000
heap
page read and write
224DB447000
heap
page read and write
1718B805000
heap
page read and write
15144B4B000
heap
page read and write
224DB350000
heap
page read and write
1514423E000
heap
page read and write
15144279000
heap
page read and write
15144269000
heap
page read and write
BDFFE7E000
stack
page read and write
1E013A40000
heap
page read and write
18C69840000
heap
page read and write
1514423A000
heap
page read and write
224DB390000
heap
page read and write
F0CE97F000
stack
page read and write
1514423E000
heap
page read and write
2680C5D0000
heap
page read and write
18C69690000
heap
page read and write
2680C590000
heap
page read and write
15144266000
heap
page read and write
1514423A000
heap
page read and write
FE05B7E000
stack
page read and write
15144269000
heap
page read and write
1514426D000
heap
page read and write
7FF8B8F71000
unkown
page execute read
2680C525000
heap
page read and write
15144266000
heap
page read and write
15144269000
heap
page read and write
15144269000
heap
page read and write
15144235000
heap
page read and write
1514423A000
heap
page read and write
15144B4B000
heap
page read and write
15144266000
heap
page read and write
A09A7C000
stack
page read and write
15144235000
heap
page read and write
D47000
heap
page read and write
1718B5AF000
heap
page read and write
1E013A6A000
heap
page read and write
15144241000
heap
page read and write
1514419A000
heap
page read and write
28696C40000
heap
page read and write
224DB442000
heap
page read and write
A09BFF000
stack
page read and write
15144266000
heap
page read and write
15144269000
heap
page read and write
15144242000
heap
page read and write
21C49D95000
heap
page read and write
91347EF000
stack
page read and write
1514426C000
heap
page read and write
2680DFE0000
heap
page read and write
97B000
stack
page read and write
2680C5C0000
heap
page read and write
15144269000
heap
page read and write
21C49AC0000
heap
page read and write
9D0000
heap
page read and write
1514423A000
heap
page read and write
15144279000
heap
page read and write
15144269000
heap
page read and write
15144460000
heap
page read and write
25806B00000
heap
page read and write
15144266000
heap
page read and write
15144242000
heap
page read and write
266747C000
stack
page read and write
2680C5C5000
heap
page read and write
15144266000
heap
page read and write
25806B30000
heap
page read and write
15144235000
heap
page read and write
1E013A82000
heap
page read and write
15144242000
heap
page read and write
15144279000
heap
page read and write
13C35795000
heap
page read and write
15144279000
heap
page read and write
151441B2000
heap
page read and write
18C69862000
heap
page read and write
1718B5B0000
heap
page read and write
21C49B50000
heap
page read and write
15144242000
heap
page read and write
15144266000
heap
page read and write
15144279000
heap
page read and write
15144266000
heap
page read and write
1514423A000
heap
page read and write
15144279000
heap
page read and write
1718B578000
heap
page read and write
1514423A000
heap
page read and write
1514423A000
heap
page read and write
15144269000
heap
page read and write
15144B4F000
heap
page read and write
1514423E000
heap
page read and write
15144242000
heap
page read and write
13C354C0000
heap
page read and write
15144279000
heap
page read and write
15144465000
heap
page read and write
15144269000
heap
page read and write
1514423A000
heap
page read and write
15144242000
heap
page read and write
1E013A60000
heap
page read and write
13C35790000
heap
page read and write
D62000
heap
page read and write
224DB409000
heap
page read and write
15144269000
heap
page read and write
1718B570000
heap
page read and write
21C49B7A000
heap
page read and write
7EE7C9C000
stack
page read and write
15144B4B000
heap
page read and write
1718B593000
heap
page read and write
15144269000
heap
page read and write
1514423A000
heap
page read and write
1514423E000
heap
page read and write
28696F80000
heap
page read and write
15144269000
heap
page read and write
26678FE000
stack
page read and write
F66A4FF000
stack
page read and write
28696C60000
heap
page read and write
13C355A1000
heap
page read and write
1514426C000
heap
page read and write
1514423A000
heap
page read and write
15144279000
heap
page read and write
18C69770000
heap
page read and write
15144279000
heap
page read and write
7FF8B8F85000
unkown
page readonly
15144269000
heap
page read and write
13C3558D000
heap
page read and write
15144279000
heap
page read and write
21C49B79000
heap
page read and write
A09AFF000
stack
page read and write
21C49CA0000
heap
page read and write
28696B60000
heap
page read and write
1718B5AF000
heap
page read and write
15144B4B000
heap
page read and write
15144B4B000
heap
page read and write
1514423A000
heap
page read and write
1514423A000
heap
page read and write
1718D0F0000
heap
page read and write
1514423A000
heap
page read and write
15144242000
heap
page read and write
2680C5C0000
heap
page read and write
7FF8B8F70000
unkown
page readonly
15144279000
heap
page read and write
15144242000
heap
page read and write
15144242000
heap
page read and write
1514423A000
heap
page read and write
15144279000
heap
page read and write
15144B33000
heap
page read and write
25806E00000
heap
page read and write
15144266000
heap
page read and write
15144269000
heap
page read and write
CD5000
heap
page read and write
15144B4B000
heap
page read and write
15144242000
heap
page read and write
15144241000
heap
page read and write
15144269000
heap
page read and write
1514423A000
heap
page read and write
15144279000
heap
page read and write
15144241000
heap
page read and write
15144242000
heap
page read and write
15144279000
heap
page read and write
15144242000
heap
page read and write
15144269000
heap
page read and write
7FF8B8F8F000
unkown
page read and write
264F000
stack
page read and write
15144269000
heap
page read and write
15144242000
heap
page read and write
7EE7D9E000
stack
page read and write
21C49B81000
heap
page read and write
15144266000
heap
page read and write
1514423A000
heap
page read and write
15144241000
heap
page read and write
15144266000
heap
page read and write
1514423A000
heap
page read and write
1514423E000
heap
page read and write
21C49B81000
heap
page read and write
151441FE000
heap
page read and write
21C499E0000
heap
page read and write
1514423E000
heap
page read and write
15144266000
heap
page read and write
15144241000
heap
page read and write
15144279000
heap
page read and write
21C49B58000
heap
page read and write
13C3558A000
heap
page read and write
1E013A45000
heap
page read and write
15144241000
heap
page read and write
15144241000
heap
page read and write
15144266000
heap
page read and write
D3B000
heap
page read and write
15144242000
heap
page read and write
15144279000
heap
page read and write
15144266000
heap
page read and write
1514423A000
heap
page read and write
18C69A60000
heap
page read and write
15144269000
heap
page read and write
9134AFF000
stack
page read and write
15144B20000
remote allocation
page read and write
15144279000
heap
page read and write
232EFE000
stack
page read and write
224DD2B0000
heap
page read and write
1514423A000
heap
page read and write
232E7E000
stack
page read and write
18C69A65000
heap
page read and write
15144266000
heap
page read and write
25806B10000
heap
page read and write
21C49B81000
heap
page read and write
15144235000
heap
page read and write
1514423A000
heap
page read and write
15144266000
heap
page read and write
1514423A000
heap
page read and write
15144279000
heap
page read and write
7FF8B8F93000
unkown
page readonly
15144266000
heap
page read and write
15144B4B000
heap
page read and write
1514423A000
heap
page read and write
15144242000
heap
page read and write
1514423E000
heap
page read and write
28696F85000
heap
page read and write
21C49B6F000
heap
page read and write
15144279000
heap
page read and write
15144269000
heap
page read and write
18C69A30000
heap
page read and write
1514423A000
heap
page read and write
15144279000
heap
page read and write
1514423A000
heap
page read and write
15144269000
heap
page read and write
18C69848000
heap
page read and write
15144279000
heap
page read and write
15144266000
heap
page read and write
1514423A000
heap
page read and write
CE0000
heap
page read and write
28696C9E000
heap
page read and write
F66A2FB000
stack
page read and write
26CF000
stack
page read and write
15144269000
heap
page read and write
15144242000
heap
page read and write
28696C90000
heap
page read and write
25806E05000
heap
page read and write
15144279000
heap
page read and write
15144269000
heap
page read and write
15144279000
heap
page read and write
15144B4F000
heap
page read and write
F66A3FE000
stack
page read and write
1514423E000
heap
page read and write
224DB360000
heap
page read and write
26676FD000
stack
page read and write
224DB690000
heap
page read and write
15144266000
heap
page read and write
1514423E000
heap
page read and write
15144279000
heap
page read and write
15144279000
heap
page read and write
7EE7D1F000
stack
page read and write
15144241000
heap
page read and write
224DB42B000
heap
page read and write
2680C598000
heap
page read and write
13C35580000
heap
page read and write
1514423A000
heap
page read and write
15144242000
heap
page read and write
974F5EC000
stack
page read and write
15144269000
heap
page read and write
15144279000
heap
page read and write
15144269000
heap
page read and write
1514423A000
heap
page read and write
1E013A6D000
heap
page read and write
1718B450000
heap
page read and write
15144266000
heap
page read and write
224DB695000
heap
page read and write
1718B550000
heap
page read and write
15144266000
heap
page read and write
974F8FE000
stack
page read and write
21C49B81000
heap
page read and write
15144269000
heap
page read and write
21C49B91000
heap
page read and write
15144B4F000
heap
page read and write
1514423A000
heap
page read and write
26675F8000
stack
page read and write
1514426C000
heap
page read and write
2680C520000
heap
page read and write
15144269000
heap
page read and write
15144269000
heap
page read and write
15144241000
heap
page read and write
15144B4B000
heap
page read and write
15144266000
heap
page read and write
1514423A000
heap
page read and write
18C69790000
heap
page read and write
15144B20000
remote allocation
page read and write
15144B20000
remote allocation
page read and write
15144266000
heap
page read and write
15144266000
heap
page read and write
266787E000
stack
page read and write
13C353C0000
heap
page read and write
1514423A000
heap
page read and write
15144B30000
heap
page read and write
15144235000
heap
page read and write
CD0000
heap
page read and write
28696C97000
heap
page read and write
25806B90000
heap
page read and write
974F87E000
stack
page read and write
15144266000
heap
page read and write
15144269000
heap
page read and write
D39000
heap
page read and write
15144B4B000
heap
page read and write
15144120000
heap
page read and write
15144B4B000
heap
page read and write
15144241000
heap
page read and write
1514423A000
heap
page read and write
27B0000
heap
page read and write
15144B44000
heap
page read and write
15144241000
heap
page read and write
15144266000
heap
page read and write
15144266000
heap
page read and write
28696CB4000
heap
page read and write
15144266000
heap
page read and write
15144266000
heap
page read and write
15144242000
heap
page read and write
25806B97000
heap
page read and write
1718B594000
heap
page read and write
15144B4B000
heap
page read and write
15144279000
heap
page read and write
15144279000
heap
page read and write
15144279000
heap
page read and write
15144241000
heap
page read and write
15144279000
heap
page read and write
15144266000
heap
page read and write
15144242000
heap
page read and write
1514423A000
heap
page read and write
15144266000
heap
page read and write
1514423E000
heap
page read and write
1E0139B0000
heap
page read and write
15144279000
heap
page read and write
FE05A7C000
stack
page read and write
1514423A000
heap
page read and write
15144241000
heap
page read and write
21C49B7C000
heap
page read and write
15144242000
heap
page read and write
21C49B71000
heap
page read and write
BDFFEFE000
stack
page read and write
15144269000
heap
page read and write
26674FD000
stack
page read and write
1E0139C0000
heap
page read and write
15144266000
heap
page read and write
1514423E000
heap
page read and write
15144279000
heap
page read and write
1718B5AA000
heap
page read and write
15144266000
heap
page read and write
2680C500000
heap
page read and write
BDFFBBC000
stack
page read and write
15144269000
heap
page read and write
F0CE8FE000
stack
page read and write
9134A7F000
stack
page read and write
1514446B000
heap
page read and write
15144242000
heap
page read and write
266767D000
stack
page read and write
1514426D000
heap
page read and write
2680C400000
heap
page read and write
266777B000
stack
page read and write
224DB40D000
heap
page read and write
1514423A000
heap
page read and write
15144B4B000
heap
page read and write
15144266000
heap
page read and write
15144279000
heap
page read and write
15144241000
heap
page read and write
21C49AE0000
heap
page read and write
15144269000
heap
page read and write
2680C5B2000
heap
page read and write
224DB442000
heap
page read and write
1514423A000
heap
page read and write
15144269000
heap
page read and write
21C49B90000
heap
page read and write
2680C4E0000
heap
page read and write
15144279000
heap
page read and write
FE05AFE000
stack
page read and write
15144269000
heap
page read and write
15144190000
heap
page read and write
15144279000
heap
page read and write
15144242000
heap
page read and write
15144266000
heap
page read and write
15144266000
heap
page read and write
15144269000
heap
page read and write
There are 407 hidden memdumps, click here to show them.