IOC Report
m6tly2Aqw4.exe

loading gif

Files

File Path
Type
Category
Malicious
m6tly2Aqw4.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Program Files\Common Files\System\symsrv.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\m6tly2Aqw4.exe
"C:\Users\user\Desktop\m6tly2Aqw4.exe"
 malicious

URLs

Name
IP
Malicious
http://5isohu.com/
unknown
http://www.aieov.com/#
unknown
http://www.aieov.com/
unknown

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows
RequireSignedAppInit_DLLs
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows
AppInit_DLLs
 malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows
LoadAppInit_DLLs
 malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
DD000
unkown
page execute and write copy
D89000
unkown
page execute and write copy
61C000
unkown
page execute and write copy
196000
unkown
page execute and write copy
30DB000
heap
page read and write
192E000
stack
page read and write
61C000
unkown
page execute and write copy
3EC1000
direct allocation
page execute and read and write
14EE000
stack
page read and write
1002B000
unkown
page execute and read and write
152D000
stack
page read and write
377F000
stack
page read and write
15FD000
stack
page read and write
822000
unkown
page execute and read and write
51000
unkown
page execute and write copy
363E000
stack
page read and write
1550000
heap
page read and write
1002D000
unkown
page execute and write copy
51000
unkown
page execute and write copy
590000
unkown
page execute and write copy
367E000
stack
page read and write
3D10000
heap
page read and write
3ED0000
direct allocation
page execute and read and write
D89000
unkown
page execute and read and write
51000
unkown
page execute and write copy
3ED4000
direct allocation
page execute and read and write
182E000
stack
page read and write
135C000
stack
page read and write
6E5000
unkown
page execute and read and write
10001000
unkown
page execute and read and write
DA000
unkown
page execute and read and write
10025000
unkown
page execute and read and write
1001E000
unkown
page execute and read and write
163E000
heap
page read and write
451000
unkown
page execute and write copy
4140000
heap
page read and write
792000
unkown
page execute and read and write
15A0000
heap
page read and write
3D00000
heap
page read and write
1630000
heap
page read and write
3ED4000
direct allocation
page execute and read and write
6AF000
unkown
page execute and write copy
125C000
stack
page read and write
825000
unkown
page execute and read and write
14A0000
heap
page read and write
15A4000
heap
page read and write
451000
unkown
page execute and write copy
B08000
unkown
page execute and read and write
1002F000
unkown
page read and write
78E000
unkown
page execute and read and write
50000
unkown
page readonly
10000000
unkown
page readonly
50000
unkown
page readonly
163A000
heap
page read and write
3D90000
direct allocation
page execute and read and write
3AC0000
heap
page read and write
6AF000
unkown
page execute and write copy
10020000
unkown
page execute and read and write
7A1000
unkown
page execute and read and write
590000
unkown
page execute and write copy
7EE30000
direct allocation
page execute and read and write
13C0000
heap
page read and write
3BC0000
direct allocation
page execute and read and write
15B0000
heap
page read and write
783000
unkown
page execute and read and write
3EC4000
direct allocation
page execute and read and write
1540000
heap
page read and write
3E90000
direct allocation
page execute and read and write
195000
unkown
page execute and read and write
There are 59 hidden memdumps, click here to show them.