IOC Report
BDQfYL99b2.exe

loading gif

Files

File Path
Type
Category
Malicious
BDQfYL99b2.exe
PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_BDQfYL99b2.exe_7bbe5769bc74a17327a538bebd597bc1fc5fff7_5d7df1a8_a3bb7f14-0094-4484-b8c1-c1187a5af28d\Report.wer
Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\Microsoft\Windows\WER\Temp\WER4E1.tmp.dmp
Mini DuMP crash report, 16 streams, Wed Jul 3 16:23:49 2024, 0x1205a4 type
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER697.tmp.WERInternalMetadata.xml
XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
dropped
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6C7.tmp.xml
XML 1.0 document, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json
JSON data
dropped
C:\Windows\appcompat\Programs\Amcache.hve
MS Windows registry file, NT/2000 or above
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\BDQfYL99b2.exe
"C:\Users\user\Desktop\BDQfYL99b2.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1596 -s 1064

URLs

Name
IP
Malicious
bossnacarpet.com
malicious
http://geoplugin.net/json.gp
178.237.33.50
http://geoplugin.net/json.gpal
unknown
http://geoplugin.net/json.gpc
unknown
http://upx.sf.net
unknown
http://geoplugin.net/json.gpG
unknown
http://geoplugin.net/json.gp/C
unknown
http://geoplugin.net/json.gpl
unknown
http://geoplugin.net/json.gpr&
unknown
http://geoplugin.net/json.gpr2
unknown
http://geoplugin.net/json.gp/
unknown
http://geoplugin.net/json.gp.
unknown
There are 2 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
vegetachcnc.com
107.173.4.18
 malicious
bossnacarpet.com
173.255.204.62
 malicious
geoplugin.net
178.237.33.50

IPs

IP
Domain
Country
Malicious
173.255.204.62
bossnacarpet.com
United States
malicious
107.173.4.18
vegetachcnc.com
United States
malicious
52.168.117.173
unknown
United States
178.237.33.50
geoplugin.net
Netherlands

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\chrome-6W1HCC
exepath
HKEY_CURRENT_USER\SOFTWARE\chrome-6W1HCC
licence
HKEY_CURRENT_USER\SOFTWARE\chrome-6W1HCC
time
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
ProgramId
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
FileId
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
LowerCaseLongPath
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
LongPathHash
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
Name
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
OriginalFileName
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
Publisher
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
Version
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
BinFileVersion
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
BinaryType
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
ProductName
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
ProductVersion
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
LinkDate
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
BinProductVersion
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
AppxPackageFullName
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
AppxPackageRelativeId
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
Size
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
Language
\REGISTRY\A\{b2f26673-e56f-e8e4-e632-faa0f22dfcd0}\Root\InventoryApplicationFile\bdqfyl99b2.exe|b039b1e7354bfdd2
Usn
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceTicket
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
DeviceId
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
ApplicationFlags
HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
0018000DDABBE6B3
There are 16 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
205CD11F000
trusted library allocation
page read and write
 malicious
400000
remote allocation
page execute and read and write
 malicious
4EA8000
heap
page read and write
 malicious
205BCE10000
trusted library allocation
page read and write
 malicious
7FFD345E3000
trusted library allocation
page execute and read and write
7FFD34786000
trusted library allocation
page read and write
7FFD34690000
trusted library allocation
page read and write
205BB1EC000
unkown
page readonly
205BB41F000
heap
page read and write
6A20000
heap
page read and write
7FFD34600000
trusted library allocation
page read and write
4F1E000
heap
page read and write
205BCDD1000
trusted library allocation
page read and write
205CCDD1000
trusted library allocation
page read and write
205BB530000
trusted library allocation
page read and write
205BB533000
trusted library allocation
page read and write
4DB5000
heap
page read and write
7FFD34790000
trusted library allocation
page read and write
7FFD345F8000
trusted library allocation
page read and write
4F07000
heap
page read and write
4F1E000
heap
page read and write
205BB39B000
heap
page read and write
7FFD34780000
trusted library allocation
page read and write
205CCDE1000
trusted library allocation
page read and write
519F000
stack
page read and write
7A69CFE000
stack
page read and write
205D55A0000
trusted library section
page read and write
205BB1E2000
unkown
page readonly
7FF412510000
trusted library allocation
page execute and read and write
7FFD3463C000
trusted library allocation
page execute and read and write
205BB280000
heap
page read and write
205CCDD8000
trusted library allocation
page read and write
4F16000
heap
page read and write
205BB510000
trusted library allocation
page read and write
7FFD345E2000
trusted library allocation
page read and write
7FFD345F0000
trusted library allocation
page read and write
7FFD3479C000
trusted library allocation
page read and write
4EA0000
heap
page read and write
7FFD3469C000
trusted library allocation
page execute and read and write
205D5670000
heap
page read and write
205BCE41000
trusted library allocation
page read and write
205BB580000
heap
page execute and read and write
7FFD347D2000
trusted library allocation
page read and write
4C60000
heap
page read and write
752F000
stack
page read and write
205D4E00000
trusted library allocation
page read and write
205BB1E0000
unkown
page readonly
7FFD345E0000
trusted library allocation
page read and write
7FFD34696000
trusted library allocation
page read and write
4D8E000
stack
page read and write
205BD184000
trusted library allocation
page read and write
7FFD347D9000
trusted library allocation
page read and write
205BB520000
heap
page read and write
205BB2C5000
heap
page read and write
7A69AFE000
stack
page read and write
48FC000
stack
page read and write
7FFD345FD000
trusted library allocation
page execute and read and write
205D56B2000
heap
page read and write
205BB2D0000
heap
page read and write
205BCE9D000
trusted library allocation
page read and write
7FFD345ED000
trusted library allocation
page execute and read and write
7A6A1FE000
stack
page read and write
205BB529000
heap
page read and write
7FFD346A0000
trusted library allocation
page execute and read and write
205BB42C000
heap
page read and write
742E000
stack
page read and write
4EE6000
heap
page read and write
4EF0000
heap
page read and write
205BB625000
heap
page read and write
7FFD347E0000
trusted library allocation
page execute and read and write
205BB370000
heap
page read and write
205BB39D000
heap
page read and write
4FA0000
heap
page read and write
4F14000
heap
page read and write
205BB35B000
heap
page read and write
7A698F2000
stack
page read and write
205CCDDD000
trusted library allocation
page read and write
7FFD347C0000
trusted library allocation
page read and write
7A699FE000
stack
page read and write
6B2F000
stack
page read and write
7FFD347A0000
trusted library allocation
page read and write
205BB620000
heap
page read and write
7A69EFF000
stack
page read and write
7A69FFE000
stack
page read and write
49FB000
stack
page read and write
205BCDF6000
trusted library allocation
page read and write
478000
remote allocation
page execute and read and write
7FFD34796000
trusted library allocation
page read and write
205CD6C2000
trusted library allocation
page read and write
205D5ADD000
trusted library section
page read and write
4FB0000
heap
page read and write
4DB0000
heap
page read and write
6C2F000
stack
page read and write
4F07000
heap
page read and write
4F1E000
heap
page read and write
7FFD347B0000
trusted library allocation
page read and write
4D40000
heap
page readonly
205BB372000
heap
page read and write
205BB33C000
heap
page read and write
205D5790000
heap
page execute and read and write
7FFD34604000
trusted library allocation
page read and write
205BB560000
heap
page read and write
4E40000
heap
page read and write
7FFD3460D000
trusted library allocation
page execute and read and write
4E9E000
stack
page read and write
205BB2A0000
heap
page read and write
7FFD34700000
trusted library allocation
page execute and read and write
4EE6000
heap
page read and write
474000
remote allocation
page execute and read and write
205BB330000
heap
page read and write
4D90000
heap
page read and write
205BB2C0000
heap
page read and write
7A69DFC000
stack
page read and write
7FFD3460B000
trusted library allocation
page execute and read and write
4E3D000
stack
page read and write
7FFD346C6000
trusted library allocation
page execute and read and write
205D57A0000
trusted library section
page read and write
7A69BFF000
stack
page read and write
7A6A0FE000
stack
page read and write
205BB41D000
heap
page read and write
205BB270000
heap
page read and write
4ED7000
heap
page read and write
7FFD345E4000
trusted library allocation
page read and write
205BB320000
trusted library allocation
page read and write
7FFD347F0000
trusted library allocation
page read and write
7FFD345F2000
trusted library allocation
page read and write
There are 116 hidden memdumps, click here to show them.