IOC Report
f9e3368715092e6a197adf1ae64d6fbe059252b4fbaf3.exe

loading gif

Files

File Path
Type
Category
Malicious
f9e3368715092e6a197adf1ae64d6fbe059252b4fbaf3.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\f9e3368715092e6a197adf1ae64d6fbe059252b4fbaf3.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\d3d9.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\AFIIEBGCAAECBGCBGCBK
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\AFIIEBGCAAECBGCBGCBKEHIJEB
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\BFHJECAA
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\ECAKKKKJDBKKFIEBKEHD
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\ECAKKKKJDBKKFIEBKEHDGCAFCB
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JEHIDHDAKJDHJKEBFIEHCAAEHD
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KJJJJDHI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\f9e3368715092e6a197adf1ae64d6fbe059252b4fbaf3.exe
"C:\Users\user\Desktop\f9e3368715092e6a197adf1ae64d6fbe059252b4fbaf3.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://23.88.106
unknown
 malicious
http://23.88.106.134/6a9f8e2503d99c04.php
23.88.106.134
 malicious
http://23.88.106.134/566d6e1ec8db6394/sqlite3.dll
23.88.106.134
 malicious
http://23.88.106.134/566d6e1ec8db6394/msvcp140.dll
23.88.106.134
 malicious
http://23.88.106.134/566d6e1ec8db6394/softokn3.dll
23.88.106.134
 malicious
http://23.88.106.134/566d6e1ec8db6394/mozglue.dll
23.88.106.134
 malicious
http://23.88.106.134/566d6e1ec8db6394/freebl3.dll
23.88.106.134
 malicious
http://23.88.106.134
unknown
 malicious
http://23.88.106.134/566d6e1ec8db6394/nss3.dll
23.88.106.134
 malicious
http://23.88.106.134/566d6e1ec8db6394/vcruntime140.dll
23.88.106.134
 malicious
http://23.88.106.134/6a9f8e2503d99c04.phpGS
unknown
http://23.88.106.134/6a9f8e2503d99c04.phpwser
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
http://23.88.106.134/566d6e1ec8db6394/softokn3.dllOV
unknown
https://duckduckgo.com/ac/?q=
unknown
http://23.88.106.134/6a9f8e2503d99c04.phpC
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
http://23.88.106.134/6a9f8e2503d99c04.php?S
unknown
http://23.88.106.134/566d6e1ec8db6394/nss3.dllj9
unknown
http://23.88.106.134/6a9f8e2503d99c04.phpm
unknown
http://23.88.106.134/566d6e1ec8db6394/nss3.dllpera
unknown
http://23.88.106.134/6a9f8e2503d99c04.phpiSS
unknown
http://23.88.106.134/6a9f8e2503d99c04.phppenSSH
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://23.88.106.134/566d6e1ec8db6394/mozglue.dllAV
unknown
http://23.88.106.134/6a9f8e2503d99c04.phpz
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
unknown
http://23.88.106.134/6a9f8e2503d99c04.php513e43049a24c4f8a56ff24fb86a0b
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
unknown
http://23.88.106.134/6a9f8e2503d99c04.phpition:
unknown
http://www.sqlite.org/copyright.html.
unknown
http://23.88.106.134y
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://23.88.106.134/6a9f8e2503d99c04.phpdus.wallet
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://www.ecosia.org/newtab/
unknown
http://23.88.106.134/566d6e1ec8db6394/freebl3.dllYW
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://23.88.106.134/6a9f8e2503d99c04.php)
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://23.88.106.134/6a9f8e2503d99c04.phpcS
unknown
http://23.88.106.134/566d6e1ec8db6394/freebl3.dlleV
unknown
http://23.88.106.134/566d6e1ec8db6394/vcruntime140.dll3x
unknown
http://23.88.106.134/566d6e1ec8db6394/vcruntime140.dll4
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://23.88.106.134/6a9f8e2503d99c04.php6
unknown
There are 42 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
23.88.106.134
unknown
United States
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
6CC3D000
unkown
page read and write
 malicious
2BA7000
heap
page read and write
 malicious
2750000
remote allocation
page execute and read and write
 malicious
22DEE000
heap
page read and write
30109000
heap
page read and write
22E5C000
heap
page read and write
22DEA000
heap
page read and write
6CC62000
unkown
page read and write
1CCCE000
stack
page read and write
6C4DF000
unkown
page readonly
61ED0000
direct allocation
page read and write
EDB000
trusted library allocation
page execute and read and write
22DEC000
heap
page read and write
22DDD000
heap
page read and write
2A20000
heap
page read and write
22DFD000
heap
page read and write
22DD6000
heap
page read and write
2F07000
heap
page read and write
22DFD000
heap
page read and write
22DEA000
heap
page read and write
2A35000
heap
page read and write
22DEE000
heap
page read and write
22DFD000
heap
page read and write
6C341000
unkown
page execute read
29142000
heap
page read and write
22DD3000
heap
page read and write
2F07000
heap
page read and write
6CC64000
unkown
page readonly
28E30000
heap
page read and write
22DE0000
heap
page read and write
2A1E000
stack
page read and write
22DFD000
heap
page read and write
F5B000
heap
page read and write
1C9FD000
stack
page read and write
6CC20000
unkown
page readonly
2890000
trusted library allocation
page read and write
43A1000
trusted library allocation
page read and write
EB0000
trusted library allocation
page read and write
750000
unkown
page execute and read and write
22DF5000
heap
page read and write
22DDB000
heap
page read and write
22DDF000
heap
page read and write
22DF5000
heap
page read and write
29E0000
trusted library allocation
page read and write
1CA4E000
stack
page read and write
750000
unkown
page readonly
2EDE000
stack
page read and write
22DE0000
heap
page read and write
2739000
stack
page read and write
D70000
heap
page read and write
2C53000
heap
page read and write
1CBA0000
heap
page read and write
29F0000
heap
page execute and read and write
F1C000
heap
page read and write
1CE4E000
heap
page read and write
D40000
heap
page read and write
2C46000
heap
page read and write
6C2A0000
unkown
page readonly
1C8BD000
stack
page read and write
6C32E000
unkown
page read and write
FAD000
heap
page read and write
22DFD000
heap
page read and write
61EB4000
direct allocation
page read and write
780000
unkown
page execute and read and write
6C525000
unkown
page readonly
6C340000
unkown
page readonly
22DD6000
heap
page read and write
EB4000
trusted library allocation
page read and write
22DFA000
heap
page read and write
291E000
stack
page read and write
2908F000
stack
page read and write
22ECF000
heap
page read and write
508E000
stack
page read and write
2B01000
trusted library allocation
page read and write
2913A000
heap
page read and write
61E00000
direct allocation
page execute and read and write
511E000
stack
page read and write
4496000
trusted library allocation
page read and write
2F00000
heap
page read and write
22DF5000
heap
page read and write
22DEE000
heap
page read and write
22DF7000
heap
page read and write
29C0000
heap
page read and write
28DE000
stack
page read and write
29D0000
heap
page readonly
2C4C000
heap
page read and write
22DC6000
heap
page read and write
EFE000
heap
page read and write
2914E000
heap
page read and write
22DF5000
heap
page read and write
22DDD000
heap
page read and write
290C0000
heap
page read and write
2BD5000
heap
page read and write
22DF5000
heap
page read and write
22DDD000
heap
page read and write
752000
unkown
page readonly
753E000
stack
page read and write
2C58000
heap
page read and write
50A0000
trusted library section
page read and write
2899000
remote allocation
page execute and read and write
2BEA000
heap
page read and write
22DFD000
heap
page read and write
22DD8000
heap
page read and write
22DFD000
heap
page read and write
22DC6000
heap
page read and write
28E71000
heap
page read and write
22DFD000
heap
page read and write
22DB0000
heap
page read and write
2C92000
heap
page read and write
28E91000
heap
page read and write
290A0000
trusted library allocation
page read and write
22DD3000
heap
page read and write
22DDF000
heap
page read and write
22DF9000
heap
page read and write
2930000
heap
page read and write
6C51E000
unkown
page read and write
2B0B000
trusted library allocation
page read and write
22DEC000
heap
page read and write
1C8FE000
stack
page read and write
4BFE000
stack
page read and write
22DFD000
heap
page read and write
2BD7000
heap
page read and write
D2E000
stack
page read and write
1CB60000
heap
page read and write
B5B000
stack
page read and write
2BA0000
heap
page read and write
22DFD000
heap
page read and write
6C332000
unkown
page readonly
22DEA000
heap
page read and write
22DC1000
heap
page read and write
7C8000
unkown
page readonly
BC0000
heap
page read and write
2920000
trusted library allocation
page execute and read and write
22DFD000
heap
page read and write
2773000
remote allocation
page execute and read and write
76BE000
stack
page read and write
28EB1000
heap
page read and write
1CB4F000
stack
page read and write
2F0B000
heap
page read and write
2974000
remote allocation
page execute and read and write
28F8E000
stack
page read and write
2C41000
heap
page read and write
2F0B000
heap
page read and write
2F0B000
heap
page read and write
273D000
stack
page read and write
22DF7000
heap
page read and write
22DEE000
heap
page read and write
A8BE000
stack
page read and write
1CB90000
heap
page read and write
D60000
heap
page read and write
22DF4000
heap
page read and write
22DC7000
heap
page read and write
29148000
heap
page read and write
22DDC000
heap
page read and write
752000
unkown
page execute and read and write
74FE000
stack
page read and write
22DFD000
heap
page read and write
22DEE000
heap
page read and write
279B000
remote allocation
page execute and read and write
29146000
heap
page read and write
E90000
trusted library allocation
page read and write
FA2000
heap
page read and write
22DFD000
heap
page read and write
3B01000
trusted library allocation
page read and write
2D9E000
stack
page read and write
6C51F000
unkown
page write copy
2E9E000
stack
page read and write
4F8E000
stack
page read and write
28E50000
heap
page read and write
6CC21000
unkown
page execute read
2C36000
heap
page read and write
CA0000
heap
page read and write
61ED4000
direct allocation
page readonly
1C7BE000
stack
page read and write
2798000
remote allocation
page execute and read and write
22DDF000
heap
page read and write
4305000
trusted library allocation
page read and write
22DD9000
heap
page read and write
A5C000
stack
page read and write
61ECD000
direct allocation
page readonly
6C31D000
unkown
page readonly
2B13000
trusted library allocation
page read and write
61ED3000
direct allocation
page read and write
4450000
trusted library allocation
page read and write
276B000
remote allocation
page readonly
22DC7000
heap
page read and write
1CDCC000
stack
page read and write
2AFE000
stack
page read and write
22DFD000
heap
page read and write
EA3000
trusted library allocation
page execute and read and write
22DD9000
heap
page read and write
2B4D000
stack
page read and write
22DD8000
heap
page read and write
263B000
stack
page read and write
1CE40000
trusted library allocation
page read and write
2986000
remote allocation
page readonly
CEE000
stack
page read and write
22DFD000
heap
page read and write
2FBF0000
heap
page read and write
22DD9000
heap
page read and write
61E01000
direct allocation
page execute read
10EF000
stack
page read and write
22DD9000
heap
page read and write
22DD9000
heap
page read and write
6C2A1000
unkown
page execute read
2C03000
heap
page read and write
2B17000
trusted library allocation
page read and write
22DFD000
heap
page read and write
22DFD000
heap
page read and write
1C77F000
stack
page read and write
4F40000
trusted library allocation
page read and write
2A30000
heap
page read and write
5130000
heap
page execute and read and write
EA4000
trusted library allocation
page read and write
22DF5000
heap
page read and write
22DC6000
heap
page read and write
780000
unkown
page readonly
E7F000
stack
page read and write
F99000
heap
page read and write
6CC36000
unkown
page readonly
22DEE000
heap
page read and write
22DEA000
heap
page read and write
ED7000
trusted library allocation
page execute and read and write
61ECC000
direct allocation
page read and write
22DF4000
heap
page read and write
22DC0000
heap
page read and write
2FBFA000
heap
page read and write
EF0000
heap
page read and write
F33000
heap
page read and write
61EB7000
direct allocation
page readonly
A7BD000
stack
page read and write
F9D000
heap
page read and write
22DF5000
heap
page read and write
6C520000
unkown
page read and write
2733000
stack
page read and write
There are 225 hidden memdumps, click here to show them.