IOC Report
T220UXIoKO.exe

loading gif

Files

File Path
Type
Category
Malicious
T220UXIoKO.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\JDAKJDAAFB.exe
PE32+ executable (GUI) x86-64, for MS Windows
dropped
 malicious
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\AAKKECFBGIIIEBGDGDAKJKKKEB
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\FBAAAKFC
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GDHDHJEBGHJKFIECBGCBGCAFII
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\HJKECAAAFHJECAAAEBFCAEBFHC
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JDAKJDAA
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\JDAKJDAAFBKFHIEBFCFB
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\JJJJEBGDAFHJEBGDGIJD
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\KFCAFIIDHIDGHIECGDGI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\T220UXIoKO.exe
"C:\Users\user\Desktop\T220UXIoKO.exe"
 malicious

URLs

Name
IP
Malicious
http://109.107.157.208/49aaa1bd4c594849.php
109.107.157.208
 malicious
http://109.107.157.208/74bc575e584e922c/softokn3.dll
109.107.157.208
 malicious
http://109.107.157.208
unknown
 malicious
http://109.107.157.208/74bc575e584e922c/vcruntime140.dll
109.107.157.208
 malicious
http://109.107.157.208/74bc575e584e922c/nss3.dll
109.107.157.208
 malicious
http://109.107.157.208/74bc575e584e922c/freebl3.dll
109.107.157.208
 malicious
http://109.107.157.208/
109.107.157.208
 malicious
http://109.107.157.208/74bc575e584e922c/mozglue.dll
109.107.157.208
 malicious
http://109.107.157.208/74bc575e584e922c/msvcp140.dll
109.107.157.208
 malicious
http://109.107.157.208/74bc575e584e922c/sqlite3.dll
109.107.157.208
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17WdsYWhtbmRlZHwxfDB8MHxab2hvIF
unknown
https://duckduckgo.com/ac/?q=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17crosoft
unknown
https://sirault.be/chrome_93.exeq
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
http://109.107.157.208/74bc575e584e922c/vcruntime140.dllO
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://sirault.be/chrome_93.exeID
unknown
http://109.107.157.208/74bc575e584e922c/vcruntime140.dll?
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://109.107.157.208/49aaa1bd4c594849.phpion:
unknown
http://109.107.157.208/74bc575e584e922c/msvcp140.dll%
unknown
https://sirault.be/chrome_93.exe
185.98.131.200
http://109.107.157.208/74bc575e584e922c/sqlite3.dllOI
unknown
http://109.107.157.208/74bc575e584e922c/msvcp140.dll4
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
https://sirault.be/chrome_93.exeB
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
http://109.107.157.208/74bc575e584e922c/nss3.dlls7
unknown
https://mozilla.org0/
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK201621kbG1nY
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://sirault.be/chrome_93.exebytes=0-2097151
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://109.107.157.208/74bc575e584e922c/sqlite3.dllK4
unknown
https://sirault.be/chrome_93.exent-Disposition:
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://sirault.be/chrome_93.exee.1
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
http://109.107.157.208FCB
unknown
https://sirault.be/m
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://109.107.157.208/74bc575e584e922c/mozglue.dll14
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
https://sirault.be/chrome_93.exe10Start0n:
unknown
https://support.mozilla.org
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://sirault.be/
unknown
There are 48 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
sirault.be
185.98.131.200

IPs

IP
Domain
Country
Malicious
109.107.157.208
unknown
unknown
malicious
185.98.131.200
sirault.be
France

Memdumps

Base Address
Regiontype
Protect
Malicious
830000
direct allocation
page execute and read and write
 malicious
90E000
heap
page read and write
 malicious
400000
unkown
page execute and read and write
 malicious
880000
direct allocation
page read and write
 malicious
20D97000
heap
page read and write
4E2000
unkown
page execute and read and write
20DB3000
heap
page read and write
740000
heap
page read and write
1F0000
heap
page read and write
61ECD000
direct allocation
page readonly
20DB3000
heap
page read and write
9BB000
heap
page read and write
492000
unkown
page execute and read and write
6C93E000
unkown
page read and write
8C0000
heap
page read and write
20D7B000
heap
page read and write
1AE02000
heap
page read and write
20DAB000
heap
page read and write
20D95000
heap
page read and write
50F000
unkown
page execute and read and write
20D92000
heap
page read and write
26E20000
heap
page read and write
197000
stack
page read and write
20D8C000
heap
page read and write
20DB1000
heap
page read and write
20D87000
heap
page read and write
2E610000
heap
page read and write
20D8A000
heap
page read and write
270E8000
heap
page read and write
20DB3000
heap
page read and write
20D8C000
heap
page read and write
20D95000
heap
page read and write
20D8F000
heap
page read and write
1ACAE000
stack
page read and write
270FA000
heap
page read and write
61ED4000
direct allocation
page readonly
820000
heap
page read and write
20D97000
heap
page read and write
45A000
unkown
page execute and read and write
20D8F000
heap
page read and write
20D97000
heap
page read and write
26EA1000
heap
page read and write
2440000
heap
page read and write
20D97000
heap
page read and write
20D95000
heap
page read and write
90A000
heap
page read and write
449000
unkown
page write copy
1AA6D000
stack
page read and write
20DB3000
heap
page read and write
20D97000
heap
page read and write
20D95000
heap
page read and write
20DA6000
heap
page read and write
20DA6000
heap
page read and write
9B000
stack
page read and write
20D97000
heap
page read and write
2E634000
heap
page read and write
41C000
unkown
page execute read
2E10C000
heap
page read and write
20D95000
heap
page read and write
20E7E000
heap
page read and write
20E34000
heap
page read and write
20D97000
heap
page read and write
20D97000
heap
page read and write
20D72000
heap
page read and write
20D8E000
heap
page read and write
6C6C1000
unkown
page execute read
20DA6000
heap
page read and write
20D98000
heap
page read and write
2490000
heap
page read and write
20D94000
heap
page read and write
1A96F000
stack
page read and write
20D8A000
heap
page read and write
20DAB000
heap
page read and write
20D93000
heap
page read and write
6C73D000
unkown
page readonly
9B0000
heap
page read and write
20DBA000
heap
page read and write
61EB7000
direct allocation
page readonly
20D92000
heap
page read and write
20D89000
heap
page read and write
26DE0000
heap
page read and write
270AE000
stack
page read and write
65F000
unkown
page readonly
20D91000
heap
page read and write
20DA6000
heap
page read and write
20D97000
heap
page read and write
20DA6000
heap
page read and write
61EB4000
direct allocation
page read and write
20D97000
heap
page read and write
20D97000
heap
page read and write
20D92000
heap
page read and write
952000
heap
page read and write
20D97000
heap
page read and write
20D95000
heap
page read and write
6C93F000
unkown
page write copy
5CB000
unkown
page execute and read and write
26E00000
heap
page read and write
20D95000
heap
page read and write
6C760000
unkown
page readonly
20DBF000
heap
page read and write
20D97000
heap
page read and write
20D95000
heap
page read and write
61E01000
direct allocation
page execute read
27070000
remote allocation
page read and write
1AE00000
trusted library allocation
page read and write
1ACF0000
heap
page read and write
20E25000
heap
page read and write
265E000
stack
page read and write
20DB3000
heap
page read and write
64A000
unkown
page execute and read and write
20D8F000
heap
page read and write
20D97000
heap
page read and write
27050000
trusted library allocation
page read and write
20D7B000
heap
page read and write
20D92000
heap
page read and write
9C2000
heap
page read and write
6C74E000
unkown
page read and write
20D94000
heap
page read and write
401000
unkown
page execute read
61ED3000
direct allocation
page read and write
7E0000
direct allocation
page execute and read and write
20D70000
heap
page read and write
2DBF0000
heap
page read and write
20D8A000
heap
page read and write
485000
unkown
page execute and read and write
20DB3000
heap
page read and write
6C752000
unkown
page readonly
20D95000
heap
page read and write
400000
unkown
page readonly
45B000
unkown
page readonly
20D8E000
heap
page read and write
20D95000
heap
page read and write
261E000
stack
page read and write
20D97000
heap
page read and write
2690000
heap
page read and write
248E000
stack
page read and write
20D98000
heap
page read and write
20DB3000
heap
page read and write
2697000
heap
page read and write
20D95000
heap
page read and write
4B1000
unkown
page execute and read and write
20D97000
heap
page read and write
1AD00000
heap
page read and write
4EF000
unkown
page execute and read and write
20D95000
heap
page read and write
20D8A000
heap
page read and write
27070000
remote allocation
page read and write
270F0000
heap
page read and write
20DB9000
heap
page read and write
1AB6D000
stack
page read and write
20D95000
heap
page read and write
20D7B000
heap
page read and write
20DA6000
heap
page read and write
900000
heap
page read and write
20D97000
heap
page read and write
9B5000
heap
page read and write
20E24000
heap
page read and write
20DAB000
heap
page read and write
20D97000
heap
page read and write
26E8D000
heap
page read and write
6C8FF000
unkown
page readonly
61ECC000
direct allocation
page read and write
20DB3000
heap
page read and write
19C000
stack
page read and write
1ABAE000
stack
page read and write
20D97000
heap
page read and write
20D9A000
heap
page read and write
825000
heap
page read and write
20D97000
heap
page read and write
5A5000
unkown
page execute and read and write
9C8000
heap
page read and write
48F000
unkown
page execute and read and write
192000
stack
page read and write
827000
heap
page read and write
51B000
unkown
page execute and read and write
270FA000
heap
page read and write
270EC000
heap
page read and write
20D93000
heap
page read and write
61E00000
direct allocation
page execute and read and write
20D95000
heap
page read and write
20D8A000
heap
page read and write
270F0000
heap
page read and write
20D95000
heap
page read and write
827000
heap
page read and write
65C000
unkown
page execute and read and write
1A86F000
stack
page read and write
20D7B000
heap
page read and write
20D8A000
heap
page read and write
1AD01000
heap
page read and write
20D97000
heap
page read and write
6C6C0000
unkown
page readonly
20D97000
heap
page read and write
20DB4000
heap
page read and write
5C5000
unkown
page execute and read and write
20D91000
heap
page read and write
20D97000
heap
page read and write
20DB9000
heap
page read and write
971000
heap
page read and write
20D97000
heap
page read and write
20D8F000
heap
page read and write
20D95000
heap
page read and write
6C940000
unkown
page read and write
20D95000
heap
page read and write
20D93000
heap
page read and write
2DB1F000
stack
page read and write
20D8A000
heap
page read and write
20D8A000
heap
page read and write
269C000
heap
page read and write
6C761000
unkown
page execute read
20DBA000
heap
page read and write
488000
unkown
page execute and read and write
61ED0000
direct allocation
page read and write
270F4000
heap
page read and write
6C945000
unkown
page readonly
269A000
heap
page read and write
27070000
remote allocation
page read and write
20D87000
heap
page read and write
20D97000
heap
page read and write
2693000
heap
page read and write
25DE000
stack
page read and write
20DB3000
heap
page read and write
4BD000
unkown
page execute and read and write
20D97000
heap
page read and write
20D7B000
heap
page read and write
1AD01000
heap
page read and write
20D97000
heap
page read and write
20D87000
heap
page read and write
There are 217 hidden memdumps, click here to show them.