Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
JIL-_Document_No._2500015903.cmd
|
Microsoft Cabinet archive data, Windows 2000/XP setup, 4294967295 bytes, 1 file, at 0x75 +A "x.exe", number 1, 39 datablocks,
0 compression
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Temp\x.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\AppData\Local\Temp\x.exe
|
"C:\Users\user\AppData\Local\Temp\x.exe"
|
|
|
|
C:\Windows\System32\cmd.exe
|
C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\JIL-_Document_No._2500015903.cmd" "
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\extrac32.exe
|
extrac32 /y "C:\Users\user\Desktop\JIL-_Document_No._2500015903.cmd" "C:\Users\user\AppData\Local\Temp\x.exe"
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://programania.com/en.htm
|
unknown
|
||
|
http://programania.com/en.zip
|
unknown
|
||
|
http://programania.com/en_source.zip
|
unknown
|
||
|
http://programania.com/index_ru.htm
|
unknown
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2276000
|
direct allocation
|
page read and write
|
|
|
|
7FB80000
|
direct allocation
|
page read and write
|
|
|
|
2079A000
|
direct allocation
|
page read and write
|
||
|
24E0000
|
heap
|
page read and write
|
||
|
20F87284000
|
heap
|
page read and write
|
||
|
20F84A50000
|
heap
|
page read and write
|
||
|
20F87283000
|
heap
|
page read and write
|
||
|
7F430000
|
direct allocation
|
page read and write
|
||
|
7FA40000
|
direct allocation
|
page read and write
|
||
|
20773000
|
direct allocation
|
page read and write
|
||
|
7FA50000
|
direct allocation
|
page read and write
|
||
|
20F84ADB000
|
heap
|
page read and write
|
||
|
7FDB0000
|
direct allocation
|
page read and write
|
||
|
7F430000
|
direct allocation
|
page read and write
|
||
|
660000
|
heap
|
page read and write
|
||
|
7ECD0000
|
direct allocation
|
page read and write
|
||
|
20F84CF3000
|
heap
|
page read and write
|
||
|
26E0C8B000
|
stack
|
page read and write
|
||
|
20F84AF8000
|
heap
|
page read and write
|
||
|
207A8000
|
direct allocation
|
page read and write
|
||
|
2891000
|
direct allocation
|
page execute and read and write
|
||
|
20F84DAC000
|
heap
|
page read and write
|
||
|
7FC00000
|
direct allocation
|
page read and write
|
||
|
20F84AF4000
|
heap
|
page read and write
|
||
|
20F84ACB000
|
heap
|
page read and write
|
||
|
20F84DA0000
|
heap
|
page read and write
|
||
|
2077C000
|
direct allocation
|
page read and write
|
||
|
2313000
|
direct allocation
|
page read and write
|
||
|
20F84A40000
|
heap
|
page read and write
|
||
|
720000
|
heap
|
page read and write
|
||
|
26E0D0E000
|
stack
|
page read and write
|
||
|
20F84AC7000
|
heap
|
page read and write
|
||
|
2075E000
|
direct allocation
|
page read and write
|
||
|
75E000
|
heap
|
page read and write
|
||
|
7F1C0000
|
direct allocation
|
page read and write
|
||
|
A4F000
|
stack
|
page read and write
|
||
|
22FD000
|
direct allocation
|
page read and write
|
||
|
7F910000
|
direct allocation
|
page read and write
|
||
|
20F84AF8000
|
heap
|
page read and write
|
||
|
20F84AF8000
|
heap
|
page read and write
|
||
|
2986000
|
direct allocation
|
page execute and read and write
|
||
|
665000
|
heap
|
page read and write
|
||
|
208AA000
|
stack
|
page read and write
|
||
|
20F84B13000
|
heap
|
page read and write
|
||
|
20F84CC0000
|
heap
|
page read and write
|
||
|
20F84AB7000
|
heap
|
page read and write
|
||
|
20F84AC7000
|
heap
|
page read and write
|
||
|
483000
|
unkown
|
page readonly
|
||
|
730000
|
direct allocation
|
page execute and read and write
|
||
|
47E000
|
unkown
|
page write copy
|
||
|
21060000
|
heap
|
page read and write
|
||
|
20F86A80000
|
trusted library allocation
|
page read and write
|
||
|
231A000
|
direct allocation
|
page read and write
|
||
|
209EF000
|
stack
|
page read and write
|
||
|
7F300000
|
direct allocation
|
page read and write
|
||
|
478000
|
unkown
|
page read and write
|
||
|
7F2F0000
|
direct allocation
|
page read and write
|
||
|
7FD10000
|
direct allocation
|
page read and write
|
||
|
20F84AD6000
|
heap
|
page read and write
|
||
|
285D000
|
direct allocation
|
page read and write
|
||
|
7FC70000
|
direct allocation
|
page read and write
|
||
|
20F84ACB000
|
heap
|
page read and write
|
||
|
7F2F0000
|
direct allocation
|
page read and write
|
||
|
20F84DA5000
|
heap
|
page read and write
|
||
|
6C0000
|
heap
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
20F84ACB000
|
heap
|
page read and write
|
||
|
21070000
|
heap
|
page read and write
|
||
|
2321000
|
direct allocation
|
page read and write
|
||
|
2073F000
|
direct allocation
|
page read and write
|
||
|
20784000
|
direct allocation
|
page read and write
|
||
|
759000
|
heap
|
page read and write
|
||
|
208AF000
|
stack
|
page read and write
|
||
|
20765000
|
direct allocation
|
page read and write
|
||
|
610000
|
heap
|
page read and write
|
||
|
478000
|
unkown
|
page write copy
|
||
|
20F84AF8000
|
heap
|
page read and write
|
||
|
20F84A70000
|
heap
|
page read and write
|
||
|
401000
|
unkown
|
page execute read
|
||
|
7FA50000
|
direct allocation
|
page read and write
|
||
|
65E000
|
stack
|
page read and write
|
||
|
6C6000
|
heap
|
page read and write
|
||
|
208AE000
|
stack
|
page execute and read and write
|
||
|
21050000
|
heap
|
page read and write
|
||
|
20F84AB0000
|
heap
|
page read and write
|
||
|
2831000
|
direct allocation
|
page execute read
|
||
|
22E0000
|
direct allocation
|
page read and write
|
||
|
2328000
|
direct allocation
|
page read and write
|
||
|
20F84B13000
|
heap
|
page read and write
|
||
|
2988000
|
direct allocation
|
page execute and read and write
|
||
|
208EE000
|
stack
|
page read and write
|
||
|
20757000
|
direct allocation
|
page read and write
|
||
|
207A1000
|
direct allocation
|
page read and write
|
||
|
288E000
|
direct allocation
|
page read and write
|
||
|
19D000
|
stack
|
page read and write
|
||
|
2304000
|
direct allocation
|
page read and write
|
||
|
400000
|
unkown
|
page readonly
|
||
|
7A7000
|
heap
|
page read and write
|
||
|
7F55B000
|
direct allocation
|
page read and write
|
||
|
6AE000
|
stack
|
page read and write
|
||
|
9B000
|
stack
|
page read and write
|
||
|
20DBF000
|
stack
|
page read and write
|
||
|
26E107F000
|
stack
|
page read and write
|
||
|
20F84ADB000
|
heap
|
page read and write
|
||
|
700000
|
heap
|
page read and write
|
||
|
2340000
|
heap
|
page read and write
|
||
|
94F000
|
stack
|
page read and write
|
||
|
2830000
|
direct allocation
|
page readonly
|
||
|
7ECD0000
|
direct allocation
|
page read and write
|
||
|
20793000
|
direct allocation
|
page read and write
|
||
|
230C000
|
direct allocation
|
page read and write
|
||
|
26E0D8E000
|
stack
|
page read and write
|
||
|
7F300000
|
direct allocation
|
page read and write
|
||
|
750000
|
heap
|
page read and write
|
||
|
20F84AF3000
|
heap
|
page read and write
|
||
|
20F84CF0000
|
heap
|
page read and write
|
||
|
20F87280000
|
heap
|
page read and write
|
||
|
24E3000
|
heap
|
page read and write
|
||
|
7F910000
|
direct allocation
|
page read and write
|
||
|
249C000
|
stack
|
page read and write
|
||
|
20CBE000
|
stack
|
page read and write
|
||
|
20F84AC3000
|
heap
|
page read and write
|
There are 112 hidden memdumps, click here to show them.