IOC Report
7rtK9LWbTc.exe

loading gif

Files

File Path
Type
Category
Malicious
7rtK9LWbTc.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\Graphics\guifx.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
\Device\Null
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\7rtK9LWbTc.exe
"C:\Users\user\Desktop\7rtK9LWbTc.exe"
 malicious
C:\ProgramData\Graphics\guifx.exe
"C:\ProgramData\Graphics\guifx.exe" /run
 malicious
C:\ProgramData\Graphics\guifx.exe
"C:\ProgramData\Graphics\guifx.exe" /run
 malicious
C:\ProgramData\Graphics\guifx.exe
"C:\ProgramData\Graphics\guifx.exe" /run
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\windows\system32\cmd.exe" /c del /q "C:\Users\user\Desktop\7rtK9LWbTc.exe" >> NUL
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://crl.thawte.com/ThawteTimestampingCA.crl0
unknown
http://ocsp.thawte.com0
unknown
http://www.initech.com0
unknown

IPs

IP
Domain
Country
Malicious
165.194.123.67
unknown
Korea Republic of
malicious

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Graphics

Memdumps

Base Address
Regiontype
Protect
Malicious
F71000
unkown
page execute read
F80000
unkown
page read and write
F84000
unkown
page readonly
291E000
stack
page read and write
8CE000
heap
page read and write
7E0000
heap
page read and write
2DDF000
stack
page read and write
28F0000
heap
page read and write
93E000
stack
page read and write
540000
heap
page read and write
C9E000
stack
page read and write
28E0000
heap
page read and write
F84000
unkown
page readonly
F80000
unkown
page write copy
94E000
stack
page read and write
2A0000
heap
page read and write
5DE000
stack
page read and write
80E000
stack
page read and write
BD0000
unkown
page read and write
BD4000
unkown
page readonly
9A8000
heap
page read and write
87E000
stack
page read and write
F7C000
unkown
page readonly
3F0000
heap
page read and write
B8F000
stack
page read and write
2BDF000
stack
page read and write
EE0000
heap
page read and write
BCC000
unkown
page readonly
67C000
stack
page read and write
F80000
unkown
page write copy
F7C000
unkown
page readonly
25C0000
heap
page read and write
AC0000
heap
page read and write
F71000
unkown
page execute read
8C0000
heap
page read and write
CDF000
stack
page read and write
F71000
unkown
page execute read
8FC000
stack
page read and write
F80000
unkown
page write copy
9B1000
heap
page read and write
912000
heap
page read and write
880000
heap
page read and write
3BE000
stack
page read and write
9FE000
heap
page read and write
2A1E000
stack
page read and write
9A0000
heap
page read and write
530000
heap
page read and write
2D80000
heap
page read and write
F7C000
unkown
page readonly
90F000
stack
page read and write
805000
heap
page read and write
F71000
unkown
page execute read
A7E000
stack
page read and write
F50000
heap
page read and write
2BE0000
heap
page read and write
F70000
unkown
page readonly
2CE8000
heap
page read and write
9F0000
heap
page read and write
800000
heap
page read and write
6FB000
stack
page read and write
F7C000
unkown
page readonly
2F5C000
stack
page read and write
2CA6000
heap
page read and write
4E0000
heap
page read and write
2D3E000
heap
page read and write
305C000
stack
page read and write
830000
heap
page read and write
8CA000
heap
page read and write
2C9F000
stack
page read and write
32B000
stack
page read and write
E60000
heap
page read and write
C6F000
stack
page read and write
C8F000
stack
page read and write
F70000
unkown
page readonly
BC1000
unkown
page execute read
4F0000
heap
page read and write
2480000
heap
page read and write
F70000
unkown
page readonly
F80000
unkown
page read and write
7C0000
heap
page read and write
E80000
heap
page read and write
9FA000
heap
page read and write
2C22000
heap
page read and write
DE0000
heap
page read and write
5BC000
stack
page read and write
F70000
unkown
page readonly
BC1000
unkown
page execute read
F84000
unkown
page readonly
A09000
heap
page read and write
56C000
stack
page read and write
370000
heap
page read and write
77B000
stack
page read and write
EE5000
heap
page read and write
982000
heap
page read and write
2B5E000
stack
page read and write
2D92000
heap
page read and write
92E000
heap
page read and write
2DD4000
heap
page read and write
BA0000
heap
page read and write
F70000
unkown
page readonly
8FD000
stack
page read and write
2E1E000
stack
page read and write
2DE0000
heap
page read and write
BC0000
unkown
page readonly
F70000
unkown
page readonly
900000
heap
page read and write
A3E000
stack
page read and write
E5E000
stack
page read and write
D6E000
stack
page read and write
77D000
stack
page read and write
2E22000
heap
page read and write
2F1F000
stack
page read and write
960000
heap
page read and write
F7C000
unkown
page readonly
F71000
unkown
page execute read
F84000
unkown
page readonly
29E0000
heap
page read and write
3E0000
heap
page read and write
2A5E000
stack
page read and write
BD4000
unkown
page readonly
BCC000
unkown
page readonly
D9F000
stack
page read and write
F80000
unkown
page read and write
990000
heap
page read and write
2B9E000
stack
page read and write
F7C000
unkown
page readonly
F71000
unkown
page execute read
BD0000
unkown
page write copy
A24000
heap
page read and write
835000
heap
page read and write
2C64000
heap
page read and write
BC0000
unkown
page readonly
8D9000
heap
page read and write
F84000
unkown
page readonly
F84000
unkown
page readonly
820000
heap
page read and write
2CDE000
stack
page read and write
908000
heap
page read and write
There are 128 hidden memdumps, click here to show them.