IOC Report
Updater.dll.exe

loading gif

Files

File Path
Type
Category
Malicious
Updater.dll.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
initial sample
 malicious
C:\ProgramData\Solid Digital\Updater.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\ProgramData\Solid Digital\Updater.dll:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\ProgramData\SynergyTop\Updater.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\ProgramData\SynergyTop\Updater.dll:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\ProgramData\TECLA\Updater.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\ProgramData\TECLA\Updater.dll:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\ProgramData\Table XI\Updater.dll
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
dropped
C:\ProgramData\Table XI\Updater.dll:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
C:\Windows\Tasks\Solid Digital.job
data
modified
C:\Windows\Tasks\SynergyTop.job
data
modified
C:\Windows\Tasks\TECLA.job
data
modified
C:\Windows\Tasks\Table XI.job
data
modified
There are 3 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Windows\System32\rundll32.exe
rundll32.exe "C:\Users\user\Desktop\Updater.dll.dll",#1
 malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\Updater.dll.dll,DllGetClassObject
 malicious
C:\Windows\System32\rundll32.exe
C:\Windows\system32\rundll32.exe "C:\ProgramData\SynergyTop\Updater.dll",Start /u
 malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\Updater.dll.dll,DllRegisterServer
 malicious
C:\Windows\System32\rundll32.exe
C:\Windows\system32\rundll32.exe "C:\ProgramData\Solid Digital\Updater.dll",Start /u
 malicious
C:\Windows\System32\rundll32.exe
rundll32.exe C:\Users\user\Desktop\Updater.dll.dll,DllRegisterServerEx
 malicious
C:\Windows\System32\rundll32.exe
C:\Windows\system32\rundll32.exe "C:\ProgramData\Table XI\Updater.dll",Start /u
 malicious
C:\Windows\System32\rundll32.exe
C:\Windows\system32\rundll32.exe "C:\ProgramData\TECLA\Updater.dll",Start /u
 malicious
C:\Windows\System32\rundll32.exe
C:\Windows\system32\rundll32.exe "C:\ProgramData\TECLA\Updater.dll",Start /u
 malicious
C:\Windows\System32\loaddll64.exe
loaddll64.exe "C:\Users\user\Desktop\Updater.dll.dll"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\cmd.exe
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Updater.dll.dll",#1
C:\Windows\System32\regsvr32.exe
regsvr32.exe /s C:\Users\user\Desktop\Updater.dll.dll
There are 3 hidden processes, click here to show them.

URLs

Name
IP
Malicious
https://185.161.251.26/viderl
unknown
https://185.161.251.26/a
unknown
https://185.161.251.26/a02
unknown
https://185.161.251.26/0.
unknown
https://185.161.251.26/161.251.26/i
unknown
https://185.161.251.26/c
unknown
https://185.161.251.26/%
unknown
https://185.161.251.26/)
unknown
https://185.161.251.26/i
unknown
https://185.161.251.26/(
unknown
https://185.161.251.26/nd
unknown
https://185.161.251.26/j
unknown
https://185.161.251.26/161.251.26/
unknown
https://185.161.251.26/vider~
unknown
https://185.161.251.26//
unknown
https://185.161.251.26/0
unknown
https://185.161.251.26/p
unknown
https://185.161.251.26/P=
unknown
https://185.161.251.26/s
unknown
https://185.161.251.26/r
unknown
https://185.161.251.26/rtificate
unknown
https://185.161.251.26/vider4
unknown
https://185.161.251.26/5
unknown
https://185.161.251.26/4
unknown
https://185.161.251.26/t
unknown
https://185.161.251.26/vider6
unknown
https://185.161.251.26/6
unknown
https://185.161.251.26/9
unknown
https://185.161.251.26/y
unknown
https://185.161.251.26/8
unknown
https://185.161.251.26/;
unknown
https://185.161.251.26/gits
unknown
https://185.161.251.26/;~
unknown
https://185.161.251.26/?
unknown
https://185.161.251.26/
unknown
https://185.161.251.26/C
unknown
https://185.161.251.26/viderH
unknown
https://185.161.251.26/H
unknown
https://185.161.251.26/vide
unknown
https://185.161.251.26/vider
unknown
https://185.161.251.26/161.251.26/vider
unknown
https://185.161.251.26/cros
unknown
https://185.161.251.26/Q
unknown
https://185.161.251.26/ography
unknown
https://185.161.251.26/161.251.26/8
unknown
https://185.161.251.26/W
unknown
https://185.161.251.26/I0
unknown
https://185.161.251.26/Y
unknown
There are 38 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
185.161.251.26
unknown
United Kingdom
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8
Blob

Memdumps

Base Address
Regiontype
Protect
Malicious
200CC076000
heap
page read and write
96A3CCC000
stack
page read and write
200CC02E000
heap
page read and write
200CC07F000
heap
page read and write
2AC37BD5000
heap
page read and write
200CC059000
heap
page read and write
200CC056000
heap
page read and write
200CC056000
heap
page read and write
200CC059000
heap
page read and write
200CC026000
heap
page read and write
7FF8B8F71000
unkown
page execute read
200CC908000
heap
page read and write
200CC082000
heap
page read and write
200CC02E000
heap
page read and write
200CC02E000
heap
page read and write
200CC02E000
heap
page read and write
200CC056000
heap
page read and write
200CC056000
heap
page read and write
10D95325000
heap
page read and write
1B472C00000
heap
page read and write
2870B4A0000
heap
page read and write
18BF3D50000
heap
page read and write
200CC056000
heap
page read and write
96A4077000
stack
page read and write
200CC059000
heap
page read and write
200CC02D000
heap
page read and write
18BD3070000
heap
page read and write
597000
heap
page read and write
200CC076000
heap
page read and write
200CC00D000
heap
page read and write
200CC073000
heap
page read and write
1B472AC2000
heap
page read and write
200CC056000
heap
page read and write
9037BFF000
stack
page read and write
200CC082000
heap
page read and write
3E4AFF000
stack
page read and write
200CC056000
heap
page read and write
2148F630000
heap
page read and write
6B0000
heap
page read and write
2148F639000
heap
page read and write
200CC059000
heap
page read and write
200CC076000
heap
page read and write
2AC37BD0000
heap
page read and write
200CC076000
heap
page read and write
29896FD0000
heap
page read and write
10D952E0000
heap
page read and write
24A93190000
heap
page read and write
200CC059000
heap
page read and write
200CC056000
heap
page read and write
200CC056000
heap
page read and write
1B472ADE000
heap
page read and write
200CC026000
heap
page read and write
2870B4E2000
heap
page read and write
18BD3141000
heap
page read and write
200CC059000
heap
page read and write
200CC02B000
heap
page read and write
200CC02D000
heap
page read and write
18BF3D85000
heap
page read and write
200CC056000
heap
page read and write
200CC026000
heap
page read and write
200CC059000
heap
page read and write
200CC076000
heap
page read and write
200CC026000
heap
page read and write
2148F840000
heap
page read and write
200CC026000
heap
page read and write
29896E10000
heap
page read and write
200CBEE0000
heap
page read and write
200CC082000
heap
page read and write
200CC059000
heap
page read and write
200CC02E000
heap
page read and write
5DB357E000
stack
page read and write
200CC059000
heap
page read and write
200CC056000
heap
page read and write
200CC076000
heap
page read and write
10D953A1000
heap
page read and write
200CC056000
heap
page read and write
2AC378C0000
heap
page read and write
200CC8E0000
remote allocation
page read and write
200CC1B5000
heap
page read and write
2870B4C0000
heap
page read and write
10D952C0000
heap
page read and write
200CC076000
heap
page read and write
200CC026000
heap
page read and write
2AC378E0000
heap
page read and write
200CC02E000
heap
page read and write
200CC026000
heap
page read and write
C51F99E000
stack
page read and write
200CC02E000
heap
page read and write
200CC056000
heap
page read and write
5B2000
heap
page read and write
200CBFB2000
heap
page read and write
7A54F7C000
stack
page read and write
200CC076000
heap
page read and write
336E2FE000
stack
page read and write
2AC37972000
heap
page read and write
200CC02E000
heap
page read and write
336DF1C000
stack
page read and write
200CC059000
heap
page read and write
200CC05B000
heap
page read and write
55238FC000
stack
page read and write
6E5000
heap
page read and write
2148F4C0000
heap
page read and write
24A931B2000
heap
page read and write
200CC056000
heap
page read and write
200CC056000
heap
page read and write
96A42FF000
stack
page read and write
200CC073000
heap
page read and write
C51FCFF000
stack
page read and write
10D953B0000
heap
page read and write
200CC908000
heap
page read and write
200CC07F000
heap
page read and write
24A93455000
heap
page read and write
2148F65B000
heap
page read and write
200CC073000
heap
page read and write
200CBE00000
heap
page read and write
96A427E000
stack
page read and write
200CC076000
heap
page read and write
2870B6C0000
heap
page read and write
200CC076000
heap
page read and write
200CC056000
heap
page read and write
200CC078000
heap
page read and write
200CC026000
heap
page read and write
200CC082000
heap
page read and write
200CC02E000
heap
page read and write
200CBF90000
heap
page read and write
2148F63D000
heap
page read and write
29896CB0000
heap
page read and write
200CC082000
heap
page read and write
200CC026000
heap
page read and write
200CC076000
heap
page read and write
200CC056000
heap
page read and write
E70C87F000
stack
page read and write
200CC026000
heap
page read and write
200CC02E000
heap
page read and write
2AC378B0000
heap
page read and write
200CC076000
heap
page read and write
200CC076000
heap
page read and write
200CC076000
heap
page read and write
24A94C10000
heap
page read and write
10D95370000
heap
page read and write
200CC059000
heap
page read and write
200CC076000
heap
page read and write
200CC026000
heap
page read and write
200CBF00000
heap
page read and write
200CC026000
heap
page read and write
200CC056000
heap
page read and write
200CC076000
heap
page read and write
18BF3D20000
heap
page read and write
200CC026000
heap
page read and write
200CC076000
heap
page read and write
580000
heap
page read and write
2AC3795B000
heap
page read and write
200CC02D000
heap
page read and write
7FF8B8F70000
unkown
page readonly
200CC026000
heap
page read and write
E70C8FE000
stack
page read and write
2000000
heap
page read and write
200CC059000
heap
page read and write
29896D90000
heap
page read and write
200CC076000
heap
page read and write
3E478C000
stack
page read and write
200CC076000
heap
page read and write
E70C58C000
stack
page read and write
200CC073000
heap
page read and write
1B472AA8000
heap
page read and write
200CC056000
heap
page read and write
1B472AD1000
heap
page read and write
24A931CE000
heap
page read and write
200CC07F000
heap
page read and write
200CC02E000
heap
page read and write
2870B3C0000
heap
page read and write
200CC900000
heap
page read and write
200CC07F000
heap
page read and write
200CC085000
heap
page read and write
96A41FB000
stack
page read and write
200CBFEE000
heap
page read and write
200CC056000
heap
page read and write
200CC02D000
heap
page read and write
200CC918000
heap
page read and write
200CC076000
heap
page read and write
1B474540000
heap
page read and write
200CC056000
heap
page read and write
200CC059000
heap
page read and write
18BF3D80000
heap
page read and write
200CC026000
heap
page read and write
200CC059000
heap
page read and write
200CC02D000
heap
page read and write
18BF3DD0000
heap
page read and write
214914A0000
heap
page read and write
29898950000
heap
page read and write
200CC082000
heap
page read and write
200CBF9B000
heap
page read and write
5523C7F000
stack
page read and write
10D95378000
heap
page read and write
552397F000
stack
page read and write
4A0000
heap
page read and write
9037CFE000
stack
page read and write
1B472AC4000
heap
page read and write
3E4A7E000
stack
page read and write
200CC078000
heap
page read and write
200CC02B000
heap
page read and write
200CC076000
heap
page read and write
200CC02B000
heap
page read and write
200CC076000
heap
page read and write
200CC073000
heap
page read and write
18BF3DF1000
heap
page read and write
200CC026000
heap
page read and write
58B000
heap
page read and write
200CC059000
heap
page read and write
200CC02B000
heap
page read and write
200CC082000
heap
page read and write
200CC073000
heap
page read and write
200CC026000
heap
page read and write
200CC00D000
heap
page read and write
200CC056000
heap
page read and write
200CC085000
heap
page read and write
200CC076000
heap
page read and write
200CC026000
heap
page read and write
2148F675000
heap
page read and write
200CC085000
heap
page read and write
200CC02E000
heap
page read and write
6E0000
heap
page read and write
200CC056000
heap
page read and write
200CC082000
heap
page read and write
10D9538F000
heap
page read and write
10D9539C000
heap
page read and write
680000
heap
page read and write
200CC076000
heap
page read and write
200CC07F000
heap
page read and write
200CC059000
heap
page read and write
200CC059000
heap
page read and write
200CC073000
heap
page read and write
200CC02E000
heap
page read and write
200CC076000
heap
page read and write
200CC076000
heap
page read and write
200CC026000
heap
page read and write
200CC076000
heap
page read and write
200CC026000
heap
page read and write
200CC059000
heap
page read and write
1B472AA0000
heap
page read and write
200CC056000
heap
page read and write
200CC026000
heap
page read and write
5DB34FE000
stack
page read and write
200CC07F000
heap
page read and write
200CC059000
heap
page read and write
29896E18000
heap
page read and write
200CC082000
heap
page read and write
7FF8B8F85000
unkown
page readonly
200CC056000
heap
page read and write
200CC073000
heap
page read and write
200CC059000
heap
page read and write
5DB347C000
stack
page read and write
18BD3080000
heap
page read and write
200CC026000
heap
page read and write
200CC076000
heap
page read and write
10D953B0000
heap
page read and write
1B472ADF000
heap
page read and write
200CC076000
heap
page read and write
200CC056000
heap
page read and write
200CC07F000
heap
page read and write
200CC026000
heap
page read and write
47B000
stack
page read and write
200CC026000
heap
page read and write
1B472960000
heap
page read and write
200CC056000
heap
page read and write
200CC076000
heap
page read and write
200CC02E000
heap
page read and write
C51F91C000
stack
page read and write
200CC07F000
heap
page read and write
200CC059000
heap
page read and write
200CC059000
heap
page read and write
10D953B2000
heap
page read and write
18BF3D30000
heap
page read and write
1B472A60000
heap
page read and write
200CC076000
heap
page read and write
200CC8E0000
remote allocation
page read and write
10D953A1000
heap
page read and write
200CC059000
heap
page read and write
10D953AB000
heap
page read and write
10D9539D000
heap
page read and write
200CC026000
heap
page read and write
10D96D70000
heap
page read and write
200CC076000
heap
page read and write
18BD30A0000
heap
page read and write
200CC076000
heap
page read and write
200CC05B000
heap
page read and write
200CC073000
heap
page read and write
200CC056000
heap
page read and write
200CC026000
heap
page read and write
24A93150000
heap
page read and write
200CC082000
heap
page read and write
200CC02E000
heap
page read and write
589000
heap
page read and write
200CC026000
heap
page read and write
200CC056000
heap
page read and write
200CC076000
heap
page read and write
200CC059000
heap
page read and write
200CBFEB000
heap
page read and write
7A54FFF000
stack
page read and write
18BD3430000
heap
page read and write
200CC059000
heap
page read and write
200CC026000
heap
page read and write
200CC059000
heap
page read and write
24A93450000
heap
page read and write
18BD312A000
heap
page read and write
7FF8B8F8F000
unkown
page read and write
29896FD5000
heap
page read and write
1F1F000
stack
page read and write
2148F5D0000
heap
page read and write
200CC059000
heap
page read and write
200CC056000
heap
page read and write
200CC059000
heap
page read and write
1B472AD9000
heap
page read and write
24A93050000
heap
page read and write
1B472AD1000
heap
page read and write
200CC02D000
heap
page read and write
200CBFDE000
heap
page read and write
200CC076000
heap
page read and write
200CC059000
heap
page read and write
200CC056000
heap
page read and write
10D95320000
heap
page read and write
200CC07F000
heap
page read and write
2148F67C000
heap
page read and write
200CC056000
heap
page read and write
1F9F000
stack
page read and write
C51FC7E000
stack
page read and write
200CC076000
heap
page read and write
200CC056000
heap
page read and write
200CC02E000
heap
page read and write
200CC073000
heap
page read and write
200CC076000
heap
page read and write
200CC059000
heap
page read and write
336DF9E000
stack
page read and write
200CC076000
heap
page read and write
96A437F000
stack
page read and write
200CC076000
heap
page read and write
29896E32000
heap
page read and write
18BD3120000
heap
page read and write
200CC056000
heap
page read and write
2148F67A000
heap
page read and write
200CC056000
heap
page read and write
200CC056000
heap
page read and write
200CC082000
heap
page read and write
200CC07F000
heap
page read and write
200CC082000
heap
page read and write
200CC056000
heap
page read and write
200CC076000
heap
page read and write
10D951E0000
heap
page read and write
2148F845000
heap
page read and write
200CC026000
heap
page read and write
2870B5C0000
heap
page read and write
200CC059000
heap
page read and write
2870B6C5000
heap
page read and write
200CC02E000
heap
page read and write
18BF3DDA000
heap
page read and write
7FF8B8F93000
unkown
page readonly
200CC059000
heap
page read and write
200CC059000
heap
page read and write
200CC076000
heap
page read and write
200CC076000
heap
page read and write
24A931C9000
heap
page read and write
29896DB0000
heap
page read and write
200CC026000
heap
page read and write
2AC37950000
heap
page read and write
200CC085000
heap
page read and write
2148F5A0000
heap
page read and write
200CC056000
heap
page read and write
200CC059000
heap
page read and write
10D95391000
heap
page read and write
200CC07F000
heap
page read and write
200CC073000
heap
page read and write
EB922FC000
stack
page read and write
200CC076000
heap
page read and write
24A93130000
heap
page read and write
EB923FF000
stack
page read and write
200CC082000
heap
page read and write
24A93198000
heap
page read and write
200CC026000
heap
page read and write
200CC059000
heap
page read and write
1B472ADF000
heap
page read and write
200CC076000
heap
page read and write
EB9237F000
stack
page read and write
200CC059000
heap
page read and write
200CC02E000
heap
page read and write
2870B4CB000
heap
page read and write
200CC1B0000
heap
page read and write
96A40FD000
stack
page read and write
200CC076000
heap
page read and write
24A931CF000
heap
page read and write
18BD3435000
heap
page read and write
336E27E000
stack
page read and write
200CC076000
heap
page read and write
200CC059000
heap
page read and write
200CC07F000
heap
page read and write
200CC082000
heap
page read and write
200CC059000
heap
page read and write
200CC026000
heap
page read and write
200CC073000
heap
page read and write
200CC026000
heap
page read and write
18BF3DDD000
heap
page read and write
200CC076000
heap
page read and write
1B472C05000
heap
page read and write
7A5527F000
stack
page read and write
200CC082000
heap
page read and write
200CC056000
heap
page read and write
200CC026000
heap
page read and write
200CC02D000
heap
page read and write
200CC076000
heap
page read and write
18BD312D000
heap
page read and write
200CC8E0000
remote allocation
page read and write
200CC07F000
heap
page read and write
200CC026000
heap
page read and write
200CC076000
heap
page read and write
24A931C9000
heap
page read and write
1B472A40000
heap
page read and write
200CC076000
heap
page read and write
200CC073000
heap
page read and write
200CC059000
heap
page read and write
200CC056000
heap
page read and write
9037AFC000
stack
page read and write
There are 410 hidden memdumps, click here to show them.