IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\ECGHJJEHDHCA\BFCGDA
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\ECGHJJEHDHCA\BGDGHJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\ECGHJJEHDHCA\DBKKFC
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\ProgramData\ECGHJJEHDHCA\EBGDHJ
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\ECGHJJEHDHCA\FBKECF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\ECGHJJEHDHCA\HJJKFB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\ECGHJJEHDHCA\IDAEHC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\ECGHJJEHDHCA\JEHIID
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
modified
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
dropped
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
data
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\sqls[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
There are 2 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious

URLs

Name
IP
Malicious
https://t.me/r8z0l
149.154.167.99
 malicious
https://steamcommunity.com/profiles/76561199698764354
malicious
https://116.202.190.18/
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://116.202.190.18:5432/softokn3.dllP
unknown
https://duckduckgo.com/ac/?q=
unknown
https://116.202.190.18:5432l
unknown
https://web.telegram.org
unknown
https://116.202.190.18:5432/msvcp140.dlldge
unknown
http://ocsp.entrust.net03
unknown
http://ocsp.entrust.net02
unknown
https://116.202.190.18:5432/softokn3.dll
unknown
https://116.202.190.18:5432/vcruntime140.dllIQ=E
unknown
https://116.202.190.18:5432/freebl3.dllEdge
unknown
https://116.202.190.18:5432/freebl3.dlla
unknown
https://116.202.190.18:5432Content-Disposition:
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://116.202.190.18:5432/sqls.dll
unknown
https://116.202.190.18:5432/reebl3.dll
unknown
https://116.202.190.18:5432/softokn3.dllZ
unknown
https://116.202.190.18:5432/mozglue.dllEdge
unknown
https://116.202.190.18:5432/freebl3.dll
unknown
https://116.202.190.18:5432/vcruntime140.dll9
unknown
https://116.202.190.18:5432/mozglue.dlls
unknown
https://116.202.190.18:5432/nss3.dll
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://116.202.190.18:5432/vcruntime140.dll/
unknown
https://116.202.190.18:5432/vcruntime140.dllser
unknown
https://t.me/i
unknown
http://crl.entrust.net/ts1ca.crl0
unknown
https://116.202.190.18:5432/sqls.dllx
unknown
https://116.202.190.18:5432/vcruntime140.dll
unknown
https://116.202.190.18:5432
unknown
http://www.sqlite.org/copyright.html.
unknown
https://116.202.190.18:5432/
unknown
https://116.202.190.18:5432fold
unknown
https://116.202.190.18:5432/.190.18:5432/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://t.me/w
unknown
https://116.202.190.18:5432/oft
unknown
http://www.entrust.net/rpa03
unknown
https://116.202.190.18:5432/nss3.dllO
unknown
https://116.202.190.18:5432/My
unknown
https://116.202.190.18:5432/softokn3.dllOMh
unknown
https://116.202.190.18:5432/mozglue.dll
unknown
http://aia.entrust.net/ts1-chain256.cer01
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://116.202.190.18:5432A
unknown
https://116.202.190.18:5432ing
unknown
https://www.ecosia.org/newtab/
unknown
https://116.202.190.18:5432/msvcp140.dll
unknown
https://116.202.190.18:5432/nss3.dllft
unknown
https://116.202.190.18:5432/vcruntime140.dllUser
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
https://116.202.190.18:5432/ng
unknown
https://116.202.190.18:5432/softokn3.dlldge
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://t.me/r8z0lF
unknown
http://crl.entrust.net/2048ca.crl0
unknown
https://www.entrust.net/rpa0
unknown
https://116.202.190.18:5432AMicrosoft
unknown
https://116.202.190.18:5432c84cgle
unknown
There are 52 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
t.me
149.154.167.99
 malicious
198.187.3.20.in-addr.arpa
unknown

IPs

IP
Domain
Country
Malicious
149.154.167.99
t.me
United Kingdom
malicious
116.202.190.18
unknown
Germany

Memdumps

Base Address
Regiontype
Protect
Malicious
400000
remote allocation
page execute and read and write
 malicious
1023000
unkown
page read and write
 malicious
1B8CF000
direct allocation
page readonly
99CF000
stack
page read and write
1570000
heap
page read and write
11B4000
heap
page read and write
FF0000
unkown
page readonly
12D70000
heap
page read and write
4B6000
remote allocation
page execute and read and write
1290000
heap
page read and write
1017000
unkown
page readonly
11C9000
heap
page read and write
122D000
heap
page read and write
491000
remote allocation
page execute and read and write
1056000
unkown
page read and write
116E000
stack
page read and write
B3C000
stack
page read and write
1B8C2000
direct allocation
page read and write
129E000
heap
page read and write
E44E000
stack
page read and write
1393000
heap
page read and write
4D5000
remote allocation
page execute and read and write
BE0000
heap
page read and write
1023000
unkown
page write copy
1890000
heap
page read and write
1268000
heap
page read and write
105A000
unkown
page readonly
1B688000
direct allocation
page execute read
10EE000
stack
page read and write
1B8EC000
heap
page read and write
15920000
heap
page read and write
F70000
heap
page read and write
12A7000
heap
page read and write
176F000
stack
page read and write
E30E000
stack
page read and write
1B8CA000
direct allocation
page readonly
1050000
heap
page read and write
1567B000
heap
page read and write
12F0E000
stack
page read and write
10AE000
heap
page read and write
1534D000
stack
page read and write
1088D000
stack
page read and write
1B88D000
direct allocation
page execute read
62F000
remote allocation
page execute and read and write
497000
remote allocation
page execute and read and write
157E000
heap
page read and write
EF3000
stack
page read and write
FF0000
unkown
page readonly
56E000
remote allocation
page execute and read and write
11EC000
heap
page read and write
DED000
stack
page read and write
48E000
remote allocation
page execute and read and write
1280000
heap
page read and write
1B8CD000
direct allocation
page readonly
11C6000
heap
page read and write
FF1000
unkown
page execute read
640000
remote allocation
page execute and read and write
1B680000
direct allocation
page execute and read and write
12D74000
heap
page read and write
BA0000
heap
page read and write
11AE000
stack
page read and write
FBE000
stack
page read and write
1B681000
direct allocation
page execute read
15922000
heap
page read and write
BE4C000
stack
page read and write
9A0D000
stack
page read and write
1130000
heap
page read and write
F50000
heap
page read and write
10F0000
heap
page read and write
1571B000
heap
page read and write
14FF000
stack
page read and write
453000
remote allocation
page execute and read and write
1397000
heap
page read and write
1585B000
heap
page read and write
15490000
heap
page read and write
155C0000
heap
page read and write
155D5000
heap
page read and write
10F5000
heap
page read and write
1B7E6000
direct allocation
page execute read
157A000
heap
page read and write
186F000
stack
page read and write
1B898000
direct allocation
page readonly
FF1000
unkown
page execute read
EFE000
stack
page read and write
BB0000
heap
page read and write
113A000
heap
page read and write
EED000
stack
page read and write
15879000
heap
page read and write
1B88F000
direct allocation
page readonly
15714000
heap
page read and write
105A000
unkown
page readonly
BE8E000
stack
page read and write
1193000
heap
page read and write
10A0000
heap
page read and write
12D5F000
stack
page read and write
1017000
unkown
page readonly
FC0000
direct allocation
page execute and read and write
10A5000
heap
page read and write
1548C000
stack
page read and write
E2CE000
stack
page read and write
1538C000
stack
page read and write
F60000
heap
page read and write
E40F000
stack
page read and write
1091E000
stack
page read and write
There are 94 hidden memdumps, click here to show them.