IOC Report
SecuriteInfo.com.Trojan.MulDrop28.21322.11468.28457.exe

loading gif

Files

File Path
Type
Category
Malicious
SecuriteInfo.com.Trojan.MulDrop28.21322.11468.28457.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\4549359\....\TemporaryFile (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Temp\csrss2.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop28.21322.11468.28457.exe
"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.MulDrop28.21322.11468.28457.exe"
 malicious
C:\Users\user\AppData\Local\Temp\csrss2.exe
C:\Users\user\AppData\Local\Temp\csrss2.exe
 malicious

URLs

Name
IP
Malicious
http://www.eyuyan.com)DVarFileInfo$
unknown
http://upx.sf.net
unknown
http://38.147.172.248:8080/apii.php
unknown

Memdumps

Base Address
Regiontype
Protect
Malicious
58B000
unkown
page read and write
760000
heap
page read and write
2170000
heap
page read and write
54B000
unkown
page readonly
86F000
stack
page read and write
596000
unkown
page readonly
530000
heap
page read and write
4CD000
unkown
page write copy
47C000
unkown
page readonly
780000
heap
page read and write
9A000
stack
page read and write
4B7000
unkown
page write copy
401000
unkown
page execute read
2440000
heap
page read and write
2471000
heap
page read and write
2150000
heap
page read and write
401000
unkown
page execute read
2434000
heap
page read and write
19D000
stack
page read and write
5A0000
heap
page read and write
84E000
heap
page read and write
400000
unkown
page readonly
4BA000
unkown
page write copy
400000
unkown
page readonly
2430000
heap
page read and write
4F3000
unkown
page read and write
1D0000
heap
page read and write
4CE000
unkown
page read and write
670000
heap
page read and write
2570000
trusted library allocation
page read and write
8AE000
stack
page read and write
4FB000
unkown
page readonly
550000
heap
page read and write
840000
heap
page read and write
4A2000
unkown
page readonly
4B7000
unkown
page write copy
2154000
heap
page read and write
572000
unkown
page write copy
4F9000
unkown
page read and write
520000
heap
page read and write
4F5000
unkown
page read and write
56E000
unkown
page write copy
4B9000
unkown
page read and write
401000
unkown
page execute read
4CD000
unkown
page write copy
19D000
stack
page read and write
401000
unkown
page execute read
4FB000
unkown
page readonly
4CA000
unkown
page read and write
47C000
unkown
page readonly
76E000
stack
page read and write
5B0000
heap
page read and write
56E000
unkown
page write copy
84A000
heap
page read and write
57F000
unkown
page read and write
9AF000
stack
page read and write
9A000
stack
page read and write
56A000
heap
page read and write
570000
unkown
page read and write
4A2000
unkown
page readonly
592000
unkown
page read and write
54B000
unkown
page readonly
400000
unkown
page readonly
57F000
unkown
page write copy
56E000
heap
page read and write
650000
heap
page read and write
560000
heap
page read and write
2570000
trusted library allocation
page read and write
2470000
heap
page read and write
4DA000
unkown
page read and write
57B000
unkown
page read and write
58F000
heap
page read and write
400000
unkown
page readonly
2210000
heap
page read and write
1D4000
heap
page read and write
596000
unkown
page readonly
There are 66 hidden memdumps, click here to show them.