Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
VALUESearchUpdater.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
|
C:\Users\user\Desktop\valuesearchn.zip
|
HTML document, ASCII text, with no line terminators
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\VALUESearchUpdater.exe
|
"C:\Users\user\Desktop\VALUESearchUpdater.exe"
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://valuesearch.co.kr/
|
unknown
|
||
|
https://valuesearch.co.kr/files/publish/valuesearchn.zip
|
3.36.251.235
|
||
|
https://valuesearch.co.kr/70
|
unknown
|
||
|
https://valuesearch.co.kr/files/publish/valuesearchn.zipGN
|
unknown
|
||
|
https://valuesearch.co.kr/files/publish/xlllibver.txtC
|
unknown
|
||
|
https://valuesearch.co.kr/files/publish/xlllibver.txttia
|
unknown
|
||
|
https://valuesearch.co.kr/files/publish/xlllibver.txt
|
3.36.251.235
|
||
|
https://valuesearch.co.kr/files/publish/
|
unknown
|
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
valuesearch.co.kr
|
3.36.251.235
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
3.36.251.235
|
valuesearch.co.kr
|
United States
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7C7000
|
stack
|
page read and write
|
||
|
C6C000
|
heap
|
page read and write
|
||
|
B40000
|
heap
|
page read and write
|
||
|
302C000
|
stack
|
page read and write
|
||
|
10F0000
|
remote allocation
|
page read and write
|
||
|
C81000
|
heap
|
page read and write
|
||
|
109D000
|
stack
|
page read and write
|
||
|
C76000
|
heap
|
page read and write
|
||
|
292B000
|
direct allocation
|
page read and write
|
||
|
C86000
|
heap
|
page read and write
|
||
|
2944000
|
direct allocation
|
page read and write
|
||
|
29CD000
|
direct allocation
|
page read and write
|
||
|
297D000
|
direct allocation
|
page read and write
|
||
|
CA0000
|
heap
|
page read and write
|
||
|
2984000
|
direct allocation
|
page read and write
|
||
|
CDC000
|
heap
|
page read and write
|
||
|
29BF000
|
direct allocation
|
page read and write
|
||
|
29E3000
|
direct allocation
|
page read and write
|
||
|
596000
|
unkown
|
page read and write
|
||
|
594000
|
unkown
|
page write copy
|
||
|
AFB000
|
stack
|
page read and write
|
||
|
C7A000
|
heap
|
page read and write
|
||
|
D7E000
|
stack
|
page read and write
|
||
|
C6D000
|
heap
|
page read and write
|
||
|
CBC000
|
heap
|
page read and write
|
||
|
29A9000
|
direct allocation
|
page read and write
|
||
|
C7D000
|
heap
|
page read and write
|
||
|
2994000
|
direct allocation
|
page read and write
|
||
|
FBF000
|
stack
|
page read and write
|
||
|
5AB000
|
unkown
|
page readonly
|
||
|
E7F000
|
stack
|
page read and write
|
||
|
29F8000
|
direct allocation
|
page read and write
|
||
|
1116000
|
heap
|
page read and write
|
||
|
29DC000
|
direct allocation
|
page read and write
|
||
|
10F0000
|
remote allocation
|
page read and write
|
||
|
CD0000
|
heap
|
page read and write
|
||
|
29C6000
|
direct allocation
|
page read and write
|
||
|
29B8000
|
direct allocation
|
page read and write
|
||
|
CA8000
|
heap
|
page read and write
|
||
|
CAE000
|
heap
|
page read and write
|
||
|
C40000
|
heap
|
page read and write
|
||
|
CBF000
|
heap
|
page read and write
|
||
|
C8E000
|
heap
|
page read and write
|
||
|
3290000
|
trusted library allocation
|
page read and write
|
||
|
B30000
|
heap
|
page read and write
|
||
|
CB3000
|
heap
|
page read and write
|
||
|
1053000
|
heap
|
page read and write
|
||
|
1110000
|
heap
|
page read and write
|
||
|
C95000
|
heap
|
page read and write
|
||
|
CDB000
|
heap
|
page read and write
|
||
|
293C000
|
direct allocation
|
page read and write
|
||
|
594000
|
unkown
|
page read and write
|
||
|
C8D000
|
heap
|
page read and write
|
||
|
29EA000
|
direct allocation
|
page read and write
|
||
|
291B000
|
direct allocation
|
page read and write
|
||
|
29A2000
|
direct allocation
|
page read and write
|
||
|
CB6000
|
heap
|
page read and write
|
||
|
1010000
|
direct allocation
|
page execute and read and write
|
||
|
29B0000
|
direct allocation
|
page read and write
|
||
|
317F000
|
stack
|
page read and write
|
||
|
1000000
|
heap
|
page read and write
|
||
|
CC3000
|
heap
|
page read and write
|
||
|
5A4000
|
unkown
|
page read and write
|
||
|
29D4000
|
direct allocation
|
page read and write
|
||
|
CB8000
|
heap
|
page read and write
|
||
|
C62000
|
heap
|
page read and write
|
||
|
C7E000
|
heap
|
page read and write
|
||
|
2960000
|
direct allocation
|
page read and write
|
||
|
10DD000
|
stack
|
page read and write
|
||
|
298B000
|
direct allocation
|
page read and write
|
||
|
300000
|
unkown
|
page readonly
|
||
|
5AD000
|
unkown
|
page readonly
|
||
|
10F0000
|
remote allocation
|
page read and write
|
||
|
2F2D000
|
stack
|
page read and write
|
||
|
3210000
|
trusted library allocation
|
page read and write
|
||
|
C9E000
|
heap
|
page read and write
|
||
|
1050000
|
heap
|
page read and write
|
||
|
C48000
|
heap
|
page read and write
|
||
|
C20000
|
heap
|
page read and write
|
||
|
2925000
|
direct allocation
|
page read and write
|
||
|
5A6000
|
unkown
|
page write copy
|
||
|
301000
|
unkown
|
page execute read
|
||
|
C9B000
|
heap
|
page read and write
|
||
|
EBE000
|
stack
|
page read and write
|
||
|
296E000
|
direct allocation
|
page read and write
|
||
|
59D000
|
unkown
|
page read and write
|
||
|
29F1000
|
direct allocation
|
page read and write
|
||
|
299B000
|
direct allocation
|
page read and write
|
||
|
307E000
|
stack
|
page read and write
|
||
|
2959000
|
direct allocation
|
page read and write
|
There are 80 hidden memdumps, click here to show them.