Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
imfsbSvc.exe
|
PE32+ executable (GUI) x86-64, for MS Windows
|
initial sample
|
 |
|
|
C:\servicereg.log
|
ASCII text, with CRLF line terminators
|
modified
|
|
|
|
C:\servicestart.log
|
ASCII text, with CRLF line terminators
|
modified
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\SysWOW64\cmd.exe
|
cmd /c sc create rJxyS binpath= "C:\Users\user\Desktop\imfsbSvc.exe" >> C:\servicereg.log 2>&1
|
|
|
|
C:\Windows\SysWOW64\sc.exe
|
sc create rJxyS binpath= "C:\Users\user\Desktop\imfsbSvc.exe"
|
|
|
|
C:\Windows\SysWOW64\cmd.exe
|
cmd /c sc start rJxyS >> C:\servicestart.log 2>&1
|
|
|
|
C:\Windows\SysWOW64\sc.exe
|
sc start rJxyS
|
|
|
|
C:\Users\user\Desktop\imfsbSvc.exe
|
C:\Users\user\Desktop\imfsbSvc.exe
|
|
|
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
61214FF000
|
stack
|
page read and write
|
||
|
66680000
|
unkown
|
page readonly
|
||
|
31EF000
|
stack
|
page read and write
|
||
|
2D48000
|
heap
|
page read and write
|
||
|
1C1E7CAB000
|
heap
|
page read and write
|
||
|
2F9F000
|
stack
|
page read and write
|
||
|
7FF6E9C58000
|
unkown
|
page readonly
|
||
|
B4E000
|
stack
|
page read and write
|
||
|
2FE0000
|
heap
|
page read and write
|
||
|
1C1E7CD1000
|
heap
|
page read and write
|
||
|
2ED0000
|
heap
|
page read and write
|
||
|
61215FE000
|
stack
|
page read and write
|
||
|
6120DFE000
|
stack
|
page read and write
|
||
|
73D000
|
stack
|
page read and write
|
||
|
1C1E8440000
|
heap
|
page read and write
|
||
|
61216FE000
|
stack
|
page read and write
|
||
|
1C1E8445000
|
heap
|
page read and write
|
||
|
6121DFD000
|
stack
|
page read and write
|
||
|
66681000
|
unkown
|
page execute read
|
||
|
6121EFE000
|
stack
|
page read and write
|
||
|
61210FE000
|
stack
|
page read and write
|
||
|
7FF6E9C21000
|
unkown
|
page execute read
|
||
|
61219FD000
|
stack
|
page read and write
|
||
|
2FDE000
|
stack
|
page read and write
|
||
|
B50000
|
heap
|
page read and write
|
||
|
1C1E7C90000
|
heap
|
page read and write
|
||
|
6121AFD000
|
stack
|
page read and write
|
||
|
61212FF000
|
stack
|
page read and write
|
||
|
666EE000
|
unkown
|
page readonly
|
||
|
6121CFD000
|
stack
|
page read and write
|
||
|
6120BFF000
|
stack
|
page read and write
|
||
|
6120FFF000
|
stack
|
page read and write
|
||
|
B0F000
|
stack
|
page read and write
|
||
|
7FF6E9C6E000
|
unkown
|
page readonly
|
||
|
7FF6E9C21000
|
unkown
|
page execute read
|
||
|
7FF6E9C6E000
|
unkown
|
page readonly
|
||
|
6670A000
|
unkown
|
page write copy
|
||
|
2FE8000
|
heap
|
page read and write
|
||
|
6670B000
|
unkown
|
page read and write
|
||
|
61218FD000
|
stack
|
page read and write
|
||
|
2D20000
|
heap
|
page read and write
|
||
|
3280000
|
heap
|
page read and write
|
||
|
1C1E8640000
|
heap
|
page read and write
|
||
|
7FF6E9C6C000
|
unkown
|
page read and write
|
||
|
7B0000
|
heap
|
page read and write
|
||
|
7FF6E9C58000
|
unkown
|
page readonly
|
||
|
1C1E8310000
|
heap
|
page read and write
|
||
|
6121BFD000
|
stack
|
page read and write
|
||
|
1C1E7CDA000
|
heap
|
page read and write
|
||
|
6670E000
|
unkown
|
page readonly
|
||
|
2E5D000
|
stack
|
page read and write
|
||
|
6120EFE000
|
stack
|
page read and write
|
||
|
6FD000
|
stack
|
page read and write
|
||
|
61213FE000
|
stack
|
page read and write
|
||
|
31F0000
|
heap
|
page read and write
|
||
|
2BCF000
|
stack
|
page read and write
|
||
|
6120CFF000
|
stack
|
page read and write
|
||
|
7FE000
|
stack
|
page read and write
|
||
|
1C1E85F0000
|
heap
|
page read and write
|
||
|
2D40000
|
heap
|
page read and write
|
||
|
7FF6E9C20000
|
unkown
|
page readonly
|
||
|
61211FE000
|
stack
|
page read and write
|
||
|
7A0000
|
heap
|
page read and write
|
||
|
2F10000
|
heap
|
page read and write
|
||
|
2E9E000
|
stack
|
page read and write
|
||
|
1C1E7CA0000
|
heap
|
page read and write
|
||
|
7FF45D140000
|
direct allocation
|
page read and write
|
||
|
1C1E7E70000
|
heap
|
page read and write
|
||
|
7FF6E9C20000
|
unkown
|
page readonly
|
||
|
1C1E7CC8000
|
heap
|
page read and write
|
||
|
7FF6E9C6C000
|
unkown
|
page write copy
|
||
|
2F5E000
|
stack
|
page read and write
|
||
|
6120AFC000
|
stack
|
page read and write
|
||
|
61217FE000
|
stack
|
page read and write
|
There are 64 hidden memdumps, click here to show them.