IOC Report
OPyF68i97j.exe

loading gif

Files

File Path
Type
Category
Malicious
OPyF68i97j.exe
PE32 executable (console) Intel 80386, for MS Windows
initial sample
 malicious
C:\Windows\Logs\logs\Secur32.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Windows\Logs\logs\brcc.exe
PE32 executable (console) Intel 80386, for MS Windows
dropped
 malicious
C:\Windows\Logs\logs\consent.exe
PE32 executable (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Windows\Logs\logs\rw32core.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
 malicious

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\OPyF68i97j.exe
"C:\Users\user\Desktop\OPyF68i97j.exe"
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "TabletPCInputServices" /tr "C:\Users\user\Desktop\OPyF68i97j.exe" /sc minute /mo 10 /ru system /f
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /run /tn "TabletPCInputServices"
 malicious
C:\Users\user\Desktop\OPyF68i97j.exe
"C:\Users\user\Desktop\OPyF68i97j.exe" -service
 malicious
C:\Users\user\Desktop\OPyF68i97j.exe
C:\Users\user\Desktop\OPyF68i97j.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "TabletPCInputServices" /tr "C:\Users\user\Desktop\OPyF68i97j.exe" /sc minute /mo 10 /ru system /f
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /run /tn "TabletPCInputServices"
 malicious
C:\Users\user\Desktop\OPyF68i97j.exe
C:\Users\user\Desktop\OPyF68i97j.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "TabletPCInputServices" /tr "C:\Users\user\Desktop\OPyF68i97j.exe" /sc minute /mo 10 /ru system /f
 malicious
C:\Windows\SysWOW64\schtasks.exe
schtasks /run /tn "TabletPCInputServices"
 malicious
C:\Windows\Logs\logs\brcc.exe
"C:\Windows\Logs\logs\brcc.exe" askg-9dwkaJU90TAE4320-FOKE904116FSAG156JEWG
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
There are 6 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://crl.thawte.com/ThawteTimestampingCA.crl0
unknown
http://ocsp.thawte.com0
unknown

Domains

Name
IP
Malicious
www.uvfr4ep.com
114.55.25.226
 malicious
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com
217.20.57.27

IPs

IP
Domain
Country
Malicious
114.55.25.226
www.uvfr4ep.com
China
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\DISMsrv
Description
HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\DemeterID
Product ID

Memdumps

Base Address
Regiontype
Protect
Malicious
1020000
heap
page read and write
2A168F02000
heap
page read and write
9C000
stack
page read and write
12CA000
heap
page read and write
490000
unkown
page readonly
539000
heap
page read and write
D80000
heap
page read and write
2A168E26000
heap
page read and write
F1E000
heap
page read and write
1342000
direct allocation
page readonly
1B7C000
stack
page read and write
491000
unkown
page execute read
540000
heap
page read and write
CBC000
stack
page read and write
5CD000
unkown
page read and write
8B2000
unkown
page readonly
1517000
heap
page read and write
ECE000
stack
page read and write
12BF000
stack
page read and write
A8BD6FD000
stack
page read and write
4FA000
heap
page read and write
1210000
direct allocation
page execute and read and write
4AE000
unkown
page write copy
6B2000
unkown
page write copy
1120000
direct allocation
page execute and read and write
1320000
direct allocation
page read and write
4A6000
unkown
page readonly
174F000
stack
page read and write
4B2000
unkown
page write copy
15A0000
heap
page read and write
2A168E02000
heap
page read and write
1510000
heap
page read and write
490000
unkown
page readonly
2A168E40000
heap
page read and write
401000
unkown
page execute and read and write
4B0000
unkown
page write copy
4B2000
unkown
page write copy
FC0000
heap
page read and write
12C0000
heap
page read and write
8B2000
unkown
page readonly
490000
heap
page read and write
4E0000
heap
page read and write
490000
unkown
page readonly
440000
heap
page read and write
1321000
direct allocation
page execute read
429000
unkown
page write copy
A8BD4FE000
stack
page read and write
FBE000
stack
page read and write
490000
unkown
page readonly
401000
unkown
page execute and read and write
551000
heap
page read and write
179F000
stack
page read and write
DB0000
heap
page read and write
D70000
heap
page read and write
4A6000
unkown
page readonly
6B2000
unkown
page write copy
6B2000
unkown
page write copy
A8BD5FE000
unkown
page readonly
A8BD7FE000
unkown
page readonly
134F000
direct allocation
page read and write
8B2000
unkown
page readonly
2A168E13000
heap
page read and write
2A169602000
trusted library allocation
page read and write
10D0000
heap
page read and write
737000
unkown
page read and write
D3C000
stack
page read and write
1550000
heap
page read and write
6B2000
unkown
page write copy
F70000
heap
page read and write
4B2000
unkown
page write copy
12FC000
stack
page read and write
4B0000
unkown
page write copy
F80000
heap
page read and write
1360000
heap
page read and write
490000
unkown
page readonly
4A6000
unkown
page readonly
10E0000
heap
page read and write
490000
unkown
page readonly
4A6000
unkown
page readonly
41D000
unkown
page read and write
14EF000
stack
page read and write
6B2000
unkown
page read and write
1220000
direct allocation
page read and write
4B0000
unkown
page write copy
2A168C60000
heap
page read and write
F00000
heap
page read and write
106E000
stack
page read and write
491000
unkown
page execute read
F07000
heap
page read and write
491000
unkown
page execute read
8B2000
unkown
page readonly
1313000
direct allocation
page read and write
4E5000
heap
page read and write
400000
unkown
page readonly
17F0000
heap
page read and write
491000
unkown
page execute read
4AE000
unkown
page write copy
4AE000
unkown
page read and write
4AE000
unkown
page read and write
48E000
stack
page read and write
C3C000
stack
page read and write
8B2000
unkown
page readonly
4A6000
unkown
page readonly
12FC000
stack
page read and write
151F000
stack
page read and write
1233000
direct allocation
page read and write
41D000
unkown
page write copy
42A000
unkown
page readonly
4B2000
unkown
page write copy
4FE000
heap
page read and write
19C000
stack
page read and write
4AE000
unkown
page read and write
1C7C000
stack
page read and write
1410000
heap
page read and write
15A7000
heap
page read and write
8B2000
unkown
page readonly
FD0000
heap
page read and write
4AE000
unkown
page read and write
14BF000
stack
page read and write
491000
unkown
page execute read
491000
unkown
page execute read
42D000
unkown
page execute and read and write
1F0000
heap
page read and write
4B2000
unkown
page write copy
F2C000
stack
page read and write
1221000
direct allocation
page execute read
490000
unkown
page readonly
13BE000
stack
page read and write
490000
unkown
page readonly
4F0000
heap
page read and write
4B2000
unkown
page read and write
10AE000
stack
page read and write
2A168C40000
heap
page read and write
1BD0000
heap
page read and write
4B2000
unkown
page write copy
13F0000
heap
page read and write
4AE000
unkown
page write copy
4B0000
unkown
page write copy
2A168D70000
trusted library allocation
page read and write
4A6000
unkown
page readonly
DBC000
stack
page read and write
2A168E2B000
heap
page read and write
491000
unkown
page execute read
4AE000
unkown
page write copy
D20000
direct allocation
page read and write
42A000
unkown
page readonly
4A6000
unkown
page readonly
6B2000
unkown
page write copy
140E000
stack
page read and write
2A168E00000
heap
page read and write
122D000
direct allocation
page readonly
8B2000
unkown
page readonly
10FF000
stack
page read and write
FCD000
stack
page read and write
F1C000
stack
page read and write
42D000
unkown
page execute and read and write
164E000
stack
page read and write
8B2000
unkown
page readonly
14FE000
stack
page read and write
A8BD17B000
stack
page read and write
1010000
heap
page read and write
4A6000
unkown
page readonly
2A168D40000
heap
page read and write
491000
unkown
page execute read
6B2000
unkown
page write copy
6B2000
unkown
page write copy
7BF000
stack
page read and write
400000
unkown
page readonly
429000
unkown
page read and write
134B000
direct allocation
page read and write
4B2000
unkown
page write copy
12CE000
heap
page read and write
13E0000
heap
page read and write
There are 163 hidden memdumps, click here to show them.