IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\ProgramData\CAKKJKKECFIDGDHIJEGDAKFBFB
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\CFHIIJDB
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EHJDGHJDBFIJKECAECAF
ASCII text, with very long lines (1717), with CRLF line terminators
dropped
C:\ProgramData\FHIDAKFIJJKJJJKEBKJE
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\GIJECGDGCBKECAKFBGCAKECGIE
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\ProgramData\HJEBGHIEBFIJKECBKFHD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\JEHIJDGI
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
dropped
C:\ProgramData\KECGDBFCBKFIDHIDHDHIECGDHC
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm
data
dropped
There are 14 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
http://147.45.47.253
unknown
 malicious
http://147.45.47.253/58b7620e0f34e81d/softokn3.dll
147.45.47.253
 malicious
http://147.45.47.253/0
unknown
 malicious
http://147.45.47.253/072aacac8f68fd5f.php
147.45.47.253
 malicious
http://147.45.47.253/58b7620e0f34e81d/sqlite3.dll
147.45.47.253
 malicious
http://147.45.47.253/58b7620e0f34e81d/vcruntime140.dll
147.45.47.253
 malicious
http://147.45.47.253/58b7620e0f34e81d/msvcp140.dll
147.45.47.253
 malicious
http://147.45.47.253/58b7620e0f34e81d/nss3.dll
147.45.47.253
 malicious
http://147.45.47.253/
147.45.47.253
 malicious
http://147.45.47.253/58b7620e0f34e81d/mozglue.dll
147.45.47.253
 malicious
http://147.45.47.253/58b7620e0f34e81d/freebl3.dll
147.45.47.253
 malicious
https://duckduckgo.com/chrome_newtab
unknown
http://147.45.47.253/58b7620e0f34e81d/msvcp140.dllc
unknown
https://duckduckgo.com/ac/?q=
unknown
http://147.45.47.253/072aacac8f68fd5f.phpData
unknown
http://147.45.47.253/072aacac8f68fd5f.php9
unknown
http://147.45.47.253IDHII
unknown
http://147.45.47.253/58b7620e0f34e81d/softokn3.dll5
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
unknown
http://147.45.47.253/58b7620e0f34e81d/softokn3.dll;
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://147.45.47.253/072aacac8f68fd5f.phpBrowser
unknown
http://147.45.47.253/072aacac8f68fd5f.phpition:
unknown
http://147.45.47.253/58b7620e0f34e81d/softokn3.dllU
unknown
http://147.45.47.253/58b7620e0f34e81d/softokn3.dllQ
unknown
http://147.45.47.253/072aacac8f68fd5f.phpllp
unknown
http://www.sqlite.org/copyright.html.
unknown
https://cdn.epnacl
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
unknown
http://147.45.47.253/072aacac8f68fd5f.phpt
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://147.45.47.253/072aacac8f68fd5f.php319
unknown
http://147.45.47.253X
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
unknown
https://cdn.ep
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://147.45.47.253/072aacac8f68fd5f.phpM
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://147.45.47.253/072aacac8f68fd5f.phpY
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
unknown
https://support.mozilla.org
unknown
http://147.45.47.253/072aacac8f68fd5f.phpEBGHIEBFIJKECBKFHD
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
unknown
http://147.45.47.253/58b7620e0f34e81d/mozglue.dllo
unknown
There are 43 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
147.45.47.253
unknown
Russian Federation
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
F6A000
heap
page read and write
 malicious
F60000
heap
page read and write
A50000
heap
page read and write
EE0000
heap
page read and write
1AF8F000
stack
page read and write
E14000
trusted library allocation
page read and write
125C000
heap
page read and write
E24000
trusted library allocation
page read and write
27291000
heap
page read and write
AA1000
heap
page read and write
1A78E000
stack
page read and write
EC0000
heap
page read and write
1ABCF000
stack
page read and write
2982000
trusted library allocation
page execute and read and write
E95000
heap
page read and write
21214000
heap
page read and write
6C8DD000
unkown
page readonly
28D0000
trusted library allocation
page read and write
34070000
heap
page read and write
2970000
heap
page read and write
61EB4000
direct allocation
page read and write
6CAE5000
unkown
page readonly
D62000
stack
page read and write
D8F000
stack
page read and write
27250000
heap
page read and write
A94000
heap
page read and write
6CA9F000
unkown
page readonly
DB0000
trusted library allocation
page read and write
4C4000
remote allocation
page execute and read and write
61ED4000
direct allocation
page readonly
E4B000
trusted library allocation
page execute and read and write
63E000
remote allocation
page execute and read and write
610000
unkown
page readonly
101D000
heap
page read and write
F9D000
heap
page read and write
587000
remote allocation
page execute and read and write
644000
unkown
page readonly
6DC000
stack
page read and write
C6B000
stack
page read and write
A8D000
heap
page read and write
1AFDE000
stack
page read and write
61ECD000
direct allocation
page readonly
1AD4D000
stack
page read and write
4D1000
remote allocation
page execute and read and write
21279000
heap
page read and write
61ED3000
direct allocation
page read and write
2900000
heap
page execute and read and write
6C8F2000
unkown
page readonly
211D0000
heap
page read and write
EE0000
heap
page read and write
27230000
heap
page read and write
211D3000
heap
page read and write
272B1000
heap
page read and write
61ED0000
direct allocation
page read and write
1AC0D000
stack
page read and write
272D1000
heap
page read and write
61E00000
direct allocation
page execute and read and write
FCE000
heap
page read and write
1AD0C000
stack
page read and write
3981000
trusted library allocation
page read and write
E0E000
stack
page read and write
1AE4D000
stack
page read and write
34A90000
heap
page read and write
B70000
heap
page read and write
B75000
heap
page read and write
1B160000
heap
page read and write
7DB000
stack
page read and write
EDE000
stack
page read and write
122F000
stack
page read and write
A6E000
heap
page read and write
4FD000
remote allocation
page execute and read and write
4B1E000
stack
page read and write
2120C000
heap
page read and write
6CAE0000
unkown
page read and write
A8B000
heap
page read and write
1253000
heap
page read and write
1250000
heap
page read and write
A68000
heap
page read and write
FAF000
heap
page read and write
211EF000
heap
page read and write
612000
unkown
page readonly
5AD000
remote allocation
page execute and read and write
3985000
trusted library allocation
page read and write
C8E000
stack
page read and write
FEE000
stack
page read and write
2983000
trusted library allocation
page read and write
288F000
stack
page read and write
F4E000
stack
page read and write
A86000
heap
page read and write
6C861000
unkown
page execute read
493000
remote allocation
page execute and read and write
49F000
remote allocation
page execute and read and write
1B26B000
heap
page read and write
DE0000
heap
page read and write
6C8EE000
unkown
page read and write
DD0000
heap
page read and write
6C860000
unkown
page readonly
EAE000
stack
page read and write
6C901000
unkown
page execute read
46A000
remote allocation
page execute and read and write
5A7000
remote allocation
page execute and read and write
D6C000
stack
page read and write
211E4000
heap
page read and write
103D000
heap
page read and write
A40000
heap
page read and write
A60000
heap
page read and write
61E01000
direct allocation
page execute read
E13000
trusted library allocation
page execute and read and write
EB0000
trusted library allocation
page execute and read and write
212D0000
heap
page read and write
1B0DD000
stack
page read and write
400000
remote allocation
page execute and read and write
27271000
heap
page read and write
4F1000
remote allocation
page execute and read and write
211F7000
heap
page read and write
211ED000
heap
page read and write
E20000
trusted library allocation
page read and write
61ECC000
direct allocation
page read and write
1AE8E000
stack
page read and write
28CE000
stack
page read and write
61EB7000
direct allocation
page readonly
6C900000
unkown
page readonly
272E2000
heap
page read and write
6CADF000
unkown
page write copy
E4D000
stack
page read and write
D68000
stack
page read and write
1B150000
heap
page read and write
DC0000
heap
page read and write
2981000
trusted library allocation
page read and write
E90000
heap
page read and write
43C000
remote allocation
page execute and read and write
500000
remote allocation
page execute and read and write
6CADE000
unkown
page read and write
There are 123 hidden memdumps, click here to show them.