IOC Report
PSqBbz.dll

loading gif

Files

File Path
Type
Category
Malicious
PSqBbz.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\version[1].txt
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\version[2].txt
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\version[1].txt
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\version[2].txt
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\version[3].txt
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\version[1].txt
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\version[2].txt
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\version[1].txt
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\version[2].txt
ASCII text, with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\user\Desktop\PSqBbz.dll,#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\PSqBbz.dll",#1
 malicious
C:\Windows\SysWOW64\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\PSqBbz.dll",#1
 malicious
C:\Windows\System32\loaddll32.exe
loaddll32.exe "C:\Users\user\Desktop\PSqBbz.dll"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\cmd.exe
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\PSqBbz.dll",#1

URLs

Name
IP
Malicious
http://skrptfiles.tracemonitors.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?dzSWVrxeStrQsUBNHRVPip
unknown
 malicious
http://www.rapidfilestorage.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?AiNuMUXtWgCZYHVfKWdbOyZdTONuHtHNz
185.22.66.16
 malicious
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?IKZGDKvYnvDMvoqTeVDzNztzWcdsCQqtM
194.67.87.38
 malicious
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?lOUeyYkXtIeVhIGvnzBNcKeTcjKtSYTFb
194.67.87.38
 malicious
http://www.rapidfilestorage.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?qpVcogWUZudKwkAahLFKQbqMKdaKllZcB
185.22.66.15
 malicious
http://www.rapidfilestorage.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?uievPixGmzVbKOzhfhviODoaAYahKgGMc
185.22.66.16
 malicious
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?SlTcUfEytvXVUBrjkwquyzjEBZVOZZQwu
194.67.87.38
 malicious
http://skrptfiles.tracemonitors.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?dzSWVrxeStrQsUBNHRVPipauUfjiGVmnu
108.156.60.94
 malicious
http://skrptfiles.tracemonitors.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?ezfLlmYmbIYiCEOghMYOoPlTXEFRmQkky
108.156.60.94
 malicious
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?lOUeyYkXtIeVhIGvnzBNcKeTcjKtSYTFb5
unknown
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?lOUeyYkXtIeVhIGvnzBNcKeTcjKtSYTFb4
unknown
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt
unknown
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txty.IE5
unknown
http://www.rapidfilestorage.com/
unknown
http://helsinki-dtc.com/efee8a9d-c845-40f1-ac21-573d1d5ce43f
unknown
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?SlTcUfEytvXVUBrjkwquyzjEBZVOZZQwuL
unknown
http://www.rapidfilestorage.com/c
unknown
http://skrptfiles.tracemonitors.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?ezfLlmYmbIYiCEOghMYOoP
unknown
http://www.rapidfilestorage.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?uievPixGmzVbKOzhfhviODoaAY
unknown
http://skrptfiles.tracemonitors.com/updates/ya/wrtzr_ytab_b_1/win/version.txt
unknown
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?IKZGDKvYnvDMvoqTeVDzNztzWcdsCQqtMT
unknown
http://skrptfiles.tracemonitors.com/flateo
unknown
http://www.rapidfilestorage.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?AiNuMUXtWgCZYHVfKWdbOyZdTO
unknown
http://skrptfiles.tracemonitors.com/
unknown
http://skrptfiles.tracemonitors.com/cB
unknown
http://helsinki-dtc.com/8
unknown
http://helsinki-dtc.com/x
unknown
http://www.rapidfilestorage.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?qpVcogWUZudKwkAahLFKQbqMKd
unknown
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?lOUeyYkXtIeVhIGvnzBNcKeTcjKtSYTFbN
unknown
http://helsinki-dtc.com/
unknown
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?IKZGDKvYnvDMvoqTeVDzNztzWcdsCQqtMa
unknown
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?lOUeyYkXtIeVhIGvnzBNcKeTcjKtSYTFb%
unknown
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?lOUeyYkXtIeVhIGvnzBNcKeTcjKtSYTFb#
unknown
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?IKZGDKvYnvDMvoqTeVDzNztzWcdsCQqtMz
unknown
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?lOUeyYkXtIeVhIGvnzBNcKeTcjKtSYTFb(
unknown
http://skrptfiles.tracemonitors.com/updates/ya/wrtzr_ytab_b_1/win/version.txt-
unknown
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?IKZGDKvYnvDMvoqTeVDzNztzWcdsCQqtM7
unknown
http://www.rapidfilestorage.com/4
unknown
http://www.rapidfilestorage.com/T4
unknown
http://helsinki-dtc.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?IKZGDKvYnvDMvoqTeVDzNztzWcdsCQqtMt
unknown
http://skrptfiles.tracemonitors.com/updates/ya/wrtzr_ytab_b_1/win/version.txt?QstVkCRArOWIiNHaHSNSbB
unknown
http://skrptfiles.tracemonitors.com//
unknown
There are 32 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
env-3936544.jcloud.kz
185.22.66.16
 malicious
d1u0l9f6kr1di3.cloudfront.net
108.156.60.94
 malicious
helsinki-dtc.com
194.67.87.38
 malicious
skrptfiles.tracemonitors.com
unknown
www.rapidfilestorage.com
unknown

IPs

IP
Domain
Country
Malicious
108.156.60.94
d1u0l9f6kr1di3.cloudfront.net
United States
malicious
185.22.66.16
env-3936544.jcloud.kz
Kazakhstan
malicious
194.67.87.38
helsinki-dtc.com
Russian Federation
malicious
185.22.66.15
unknown
Kazakhstan
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
3397000
heap
page read and write
4840000
heap
page read and write
4D3C000
stack
page read and write
33E7000
heap
page read and write
2E45000
heap
page read and write
2DE3000
heap
page read and write
33E7000
heap
page read and write
33FF000
heap
page read and write
30B7000
heap
page read and write
50B0000
heap
page read and write
5580000
trusted library allocation
page read and write
4F60000
heap
page read and write
3109000
heap
page read and write
32F0000
heap
page read and write
2E45000
heap
page read and write
334A000
heap
page read and write
5300000
heap
page read and write
33FC000
heap
page read and write
4FA0000
heap
page read and write
31A0000
heap
page read and write
3138000
heap
page read and write
2E06000
heap
page read and write
5120000
heap
page read and write
2E4B000
heap
page read and write
2E45000
heap
page read and write
A80000
heap
page read and write
3139000
heap
page read and write
30C3000
heap
page read and write
3122000
heap
page read and write
30D1000
heap
page read and write
2E39000
heap
page read and write
492F000
stack
page read and write
4E00000
heap
page read and write
2DE3000
heap
page read and write
5130000
heap
page read and write
3129000
heap
page read and write
B9E000
stack
page read and write
30AC000
heap
page read and write
30AF000
heap
page read and write
3138000
heap
page read and write
5100000
heap
page read and write
32F3000
heap
page read and write
54E0000
heap
page read and write
630000
heap
page read and write
8A0000
heap
page read and write
3138000
heap
page read and write
31EE000
stack
page read and write
3397000
heap
page read and write
3126000
heap
page read and write
2E06000
heap
page read and write
4860000
heap
page read and write
50B3000
heap
page read and write
B70000
heap
page read and write
2DD7000
heap
page read and write
2E41000
heap
page read and write
4A1F000
stack
page read and write
2C7E000
stack
page read and write
2DE6000
heap
page read and write
2D50000
heap
page read and write
3110000
heap
page read and write
3122000
heap
page read and write
2E50000
heap
page read and write
2DE3000
heap
page read and write
24C0000
heap
page read and write
5830000
trusted library allocation
page read and write
33E7000
heap
page read and write
2CC0000
heap
page read and write
3371000
heap
page read and write
3393000
heap
page read and write
4A2E000
stack
page read and write
4DEE000
stack
page read and write
2DE6000
heap
page read and write
33C7000
heap
page read and write
4CF0000
heap
page read and write
6CE000
stack
page read and write
33FC000
heap
page read and write
4DBD000
stack
page read and write
4E9F000
stack
page read and write
3109000
heap
page read and write
3109000
heap
page read and write
3367000
heap
page read and write
33FF000
heap
page read and write
3122000
heap
page read and write
33F0000
heap
page read and write
3129000
heap
page read and write
312D000
heap
page read and write
2E4B000
heap
page read and write
30A4000
heap
page read and write
30C6000
heap
page read and write
30C8000
heap
page read and write
4EE0000
heap
page read and write
310F000
heap
page read and write
3138000
heap
page read and write
303E000
stack
page read and write
4D7D000
stack
page read and write
2E41000
heap
page read and write
35AC000
stack
page read and write
30C3000
heap
page read and write
33C7000
heap
page read and write
2E5D000
heap
page read and write
4CE0000
heap
page read and write
2E39000
heap
page read and write
BFB000
stack
page read and write
4DFE000
stack
page read and write
4A7E000
stack
page read and write
2DCA000
heap
page read and write
3397000
heap
page read and write
33F0000
heap
page read and write
31BE000
stack
page read and write
4E00000
heap
page read and write
5510000
trusted library allocation
page read and write
33FC000
heap
page read and write
3397000
heap
page read and write
4D40000
heap
page read and write
3122000
heap
page read and write
308A000
heap
page read and write
2E45000
heap
page read and write
3138000
heap
page read and write
3080000
heap
page read and write
50E0000
heap
page read and write
5B30000
heap
page read and write
31A5000
heap
page read and write
2DE6000
heap
page read and write
50F0000
trusted library allocation
page read and write
2E4B000
heap
page read and write
33E7000
heap
page read and write
48EE000
stack
page read and write
3138000
heap
page read and write
51A0000
heap
page read and write
33FF000
heap
page read and write
33F0000
heap
page read and write
32AF000
stack
page read and write
4EDC000
stack
page read and write
312D000
heap
page read and write
A95000
heap
page read and write
2D90000
heap
page read and write
4DE0000
heap
page read and write
5B40000
heap
page read and write
3CC000
stack
page read and write
2E39000
heap
page read and write
2E21000
heap
page read and write
4963000
heap
page read and write
2E39000
heap
page read and write
3129000
heap
page read and write
3340000
heap
page read and write
3122000
heap
page read and write
4E3E000
stack
page read and write
3110000
heap
page read and write
356C000
stack
page read and write
33F0000
heap
page read and write
33F7000
heap
page read and write
7DB000
stack
page read and write
312D000
heap
page read and write
3129000
heap
page read and write
4960000
heap
page read and write
2E06000
heap
page read and write
312D000
heap
page read and write
33F7000
heap
page read and write
30D1000
heap
page read and write
2E39000
heap
page read and write
4D60000
heap
page read and write
3138000
heap
page read and write
52C0000
heap
page read and write
4F6F000
stack
page read and write
2DE6000
heap
page read and write
2E1B000
heap
page read and write
33C7000
heap
page read and write
2E39000
heap
page read and write
2E1B000
heap
page read and write
3397000
heap
page read and write
312D000
heap
page read and write
5830000
trusted library allocation
page read and write
68E000
stack
page read and write
2E1B000
heap
page read and write
2E50000
heap
page read and write
2E4B000
heap
page read and write
4B80000
heap
page read and write
2E41000
heap
page read and write
33C0000
heap
page read and write
3368000
heap
page read and write
33F7000
heap
page read and write
33F7000
heap
page read and write
3122000
heap
page read and write
A9F000
stack
page read and write
312D000
heap
page read and write
482F000
stack
page read and write
2DB8000
heap
page read and write
5260000
heap
page read and write
51A0000
heap
page read and write
2CE0000
heap
page read and write
46AC000
stack
page read and write
5130000
heap
page read and write
4F2D000
stack
page read and write
49AE000
stack
page read and write
2E41000
heap
page read and write
4D2F000
stack
page read and write
2E5D000
heap
page read and write
2E1B000
heap
page read and write
2E06000
heap
page read and write
3122000
heap
page read and write
466C000
stack
page read and write
31F5000
heap
page read and write
5390000
heap
page read and write
6F0000
heap
page read and write
2E06000
heap
page read and write
2D60000
heap
page read and write
2DE6000
heap
page read and write
2530000
heap
page read and write
2E45000
heap
page read and write
2CB0000
heap
page read and write
5140000
heap
page read and write
2DA0000
heap
page read and write
BEE000
stack
page read and write
BEB000
stack
page read and write
30D6000
heap
page read and write
4B20000
heap
page read and write
2E4E000
heap
page read and write
33FC000
heap
page read and write
4C70000
trusted library allocation
page read and write
2DE7000
heap
page read and write
2DD9000
heap
page read and write
326D000
stack
page read and write
4B40000
heap
page read and write
32F0000
heap
page read and write
5570000
heap
page read and write
33FC000
heap
page read and write
4D6E000
stack
page read and write
5180000
heap
page read and write
52B0000
heap
page read and write
5420000
heap
page read and write
A39000
stack
page read and write
54C0000
heap
page read and write
30D6000
heap
page read and write
2E39000
heap
page read and write
2C7A000
stack
page read and write
2DE0000
heap
page read and write
312D000
heap
page read and write
35B0000
heap
page read and write
2E39000
heap
page read and write
3388000
heap
page read and write
2540000
heap
page read and write
4FAF000
stack
page read and write
52E0000
heap
page read and write
33F1000
heap
page read and write
51A3000
heap
page read and write
33C7000
heap
page read and write
4C4E000
stack
page read and write
2E1B000
heap
page read and write
33C7000
heap
page read and write
35F0000
heap
page read and write
2E06000
heap
page read and write
33C7000
heap
page read and write
2D9A000
heap
page read and write
4E10000
heap
page read and write
3138000
heap
page read and write
33CE000
heap
page read and write
5120000
heap
page read and write
312D000
heap
page read and write
337A000
heap
page read and write
4E23000
heap
page read and write
33E7000
heap
page read and write
307E000
stack
page read and write
5B50000
trusted library allocation
page read and write
4D43000
heap
page read and write
312A000
heap
page read and write
52E0000
heap
page read and write
4F80000
heap
page read and write
2E41000
heap
page read and write
33CD000
heap
page read and write
33F0000
heap
page read and write
30D6000
heap
page read and write
33FF000
heap
page read and write
3122000
heap
page read and write
A90000
heap
page read and write
8AF000
heap
page read and write
2E45000
heap
page read and write
3109000
heap
page read and write
4C8E000
stack
page read and write
4CCE000
stack
page read and write
4F20000
heap
page read and write
3390000
heap
page read and write
2E4B000
heap
page read and write
312A000
heap
page read and write
2E06000
heap
page read and write
2D2E000
stack
page read and write
312B000
heap
page read and write
4E60000
heap
page read and write
2E1B000
heap
page read and write
8AB000
heap
page read and write
4F6E000
stack
page read and write
4FF0000
heap
page read and write
5500000
heap
page read and write
31F0000
heap
page read and write
3109000
heap
page read and write
4A30000
heap
page read and write
4CE0000
heap
page read and write
5460000
heap
page read and write
2E4B000
heap
page read and write
33E7000
heap
page read and write
33CE000
heap
page read and write
33F7000
heap
page read and write
2C7A000
stack
page read and write
33F7000
heap
page read and write
33F7000
heap
page read and write
33FC000
heap
page read and write
48A0000
heap
page read and write
2DB7000
heap
page read and write
3122000
heap
page read and write
2E06000
heap
page read and write
322E000
stack
page read and write
5B40000
trusted library allocation
page read and write
3397000
heap
page read and write
310E000
heap
page read and write
2DE5000
heap
page read and write
33E7000
heap
page read and write
3397000
heap
page read and write
2E45000
heap
page read and write
2DC8000
heap
page read and write
4B43000
heap
page read and write
312D000
heap
page read and write
47EE000
stack
page read and write
2E1B000
heap
page read and write
312B000
heap
page read and write
30B9000
heap
page read and write
310F000
heap
page read and write
3383000
heap
page read and write
2E39000
heap
page read and write
30B0000
heap
page read and write
2CC000
stack
page read and write
33C7000
heap
page read and write
4E20000
heap
page read and write
3138000
heap
page read and write
2E5D000
heap
page read and write
2CBE000
stack
page read and write
3378000
heap
page read and write
2E45000
heap
page read and write
3300000
heap
page read and write
2E5B000
heap
page read and write
33F0000
heap
page read and write
2DD3000
heap
page read and write
33E7000
heap
page read and write
3390000
heap
page read and write
2E4B000
heap
page read and write
3392000
heap
page read and write
5010000
heap
page read and write
33E7000
heap
page read and write
5123000
heap
page read and write
30D1000
heap
page read and write
2E4B000
heap
page read and write
2D90000
heap
page read and write
2E45000
heap
page read and write
5190000
trusted library allocation
page read and write
2DC1000
heap
page read and write
4DAF000
stack
page read and write
4CE3000
heap
page read and write
52C0000
heap
page read and write
312A000
heap
page read and write
4E50000
heap
page read and write
3390000
heap
page read and write
2E1B000
heap
page read and write
50A0000
heap
page read and write
4B10000
heap
page read and write
51C0000
heap
page read and write
46B0000
heap
page read and write
2D50000
heap
page read and write
54E0000
heap
page read and write
3383000
heap
page read and write
2E50000
heap
page read and write
2DE3000
heap
page read and write
5180000
heap
page read and write
49EF000
stack
page read and write
33FC000
heap
page read and write
4E20000
heap
page read and write
53E0000
heap
page read and write
640000
heap
page read and write
33CE000
heap
page read and write
2E4B000
heap
page read and write
There are 367 hidden memdumps, click here to show them.