IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\ProgramData\HJJDGHCBGD.exe
MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
dropped
 malicious
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\l2[1].exe
MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
dropped
 malicious
C:\ProgramData\AAKKKEBFCGDBGDGCFHCB
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\BAEHIEBG
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\DAEBFHJKJEBFCBFHDAEG
ASCII text, with very long lines (1809), with CRLF line terminators
dropped
C:\ProgramData\DBKEHDGD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\EBAFHCBFHDHCAAKFHDGDBKFCGC
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IEHDBGDHDAECBGDHJKFIDGCBFB
SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
dropped
C:\ProgramData\IIIJECAEGDHIDHJKKKKF
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\JJKJDAEBFCBKECBGDBFCFBKKKF
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 17 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\ProgramData\HJJDGHCBGD.exe
"C:\ProgramData\HJJDGHCBGD.exe"
malicious
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
 malicious
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe
 malicious
C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\user\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\ProgramData\HJJDGHCBGD.exe"
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
There are 1 hidden processes, click here to show them.

URLs

Name
IP
Malicious
http://193.176.190.41/9e7fbd3f0393ef32/mozglue.dll
193.176.190.41
 malicious
http://193.176.190.41/9e7fbd3f0393ef32/mozglue.dll9U
unknown
 malicious
http://193.176.190.41/9e7fbd3f0393ef32/nss3.dll:
unknown
 malicious
http://193.176.190.41/2fa883eebd632382.phpb
unknown
 malicious
http://193.176.190.41/9e7fbd3f0393ef32/vcruntime140.dll
193.176.190.41
 malicious
http://193.176.190.41/2fa883eebd632382.phption:
unknown
 malicious
https://aldiablo.cl/karu/l2.exe
186.64.114.115
 malicious
http://193.176.190.41/9e7fbd3f0393ef32/msvcp140.dll
193.176.190.41
 malicious
http://193.176.190.41/9e7fbd3f0393ef32/freebl3.dll
193.176.190.41
 malicious
http://193.176.190.41/9e7fbd3f0393ef32/nss3.dll
193.176.190.41
 malicious
http://193.176.190.41/9e7fbd3f0393ef32/sqlite3.dll
193.176.190.41
 malicious
http://193.176.190.41/9e7fbd3f0393ef32/softokn3.dll
193.176.190.41
 malicious
http://193.176.190.41/
193.176.190.41
 malicious
http://193.176.190.41/2fa883eebd632382.php
193.176.190.41
 malicious
http://193.176.190.41
unknown
 malicious
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
https://duckduckgo.com/ac/?q=
unknown
http://ocsp.sectigo.com0
unknown
http://ocsp.entrust.net03
unknown
http://ocsp.entrust.net02
unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
http://crl.entrust.net/ts1ca.crl0
unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
unknown
http://www.sqlite.org/copyright.html.
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://sectigo.com/CPS0
unknown
https://mozilla.org0/
unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://www.entrust.net/rpa03
unknown
http://193.176.190.41U
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Ed1aWxkV
unknown
http://aia.entrust.net/ts1-chain256.cer01
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
unknown
http://193.176.190.41/2fa883eebd632382.php9a9c4a2f8b514.cdf-ms
unknown
http://193.176.190.41EHCB
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17mluIFdhbGxldHxmbmpobWtoaG1rYm
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
http://193.176.190.41/2fa883eebd632382.phpTgHw
unknown
https://support.mozilla.org
unknown
https://aldiablo.cl/
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://crl.entrust.net/2048ca.crl0
unknown
https://www.entrust.net/rpa0
unknown
There are 46 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
aldiablo.cl
186.64.114.115

IPs

IP
Domain
Country
Malicious
193.176.190.41
unknown
unknown
malicious
186.64.114.115
aldiablo.cl
Chile

Memdumps

Base Address
Regiontype
Protect
Malicious
EDA000
heap
page read and write
 malicious
A22000
unkown
page readonly
 malicious
400000
unkown
page readonly
401000
unkown
page execute and write copy
404000
unkown
page execute and read and write
E8F000
stack
page read and write
4D1000
remote allocation
page execute and read and write
1AFCD000
stack
page read and write
61ECD000
direct allocation
page readonly
1124000
heap
page read and write
F8E000
stack
page read and write
6C2D0000
unkown
page readonly
2B7E000
stack
page read and write
1064000
heap
page read and write
61ED3000
direct allocation
page read and write
1ACDE000
stack
page read and write
10B0000
heap
page read and write
2763E000
stack
page read and write
9C000
stack
page read and write
401000
unkown
page execute read
1B384000
heap
page read and write
B79000
unkown
page write copy
49F000
remote allocation
page execute and read and write
21327000
heap
page read and write
109F000
stack
page read and write
DC0000
heap
page read and write
BFA000
stack
page read and write
2B1B000
trusted library allocation
page execute and read and write
B79000
unkown
page write copy
1131000
heap
page read and write
5310000
heap
page execute and read and write
4F1000
remote allocation
page execute and read and write
2AE4000
trusted library allocation
page read and write
6C54E000
unkown
page read and write
C00000
heap
page read and write
10F0000
heap
page read and write
D55000
stack
page read and write
C0A000
heap
page read and write
1B270000
heap
page read and write
400000
unkown
page readonly
1B0CD000
stack
page read and write
D3E000
stack
page read and write
21309000
heap
page read and write
F90000
heap
page read and write
1ADDE000
stack
page read and write
4EEE000
stack
page read and write
1AC9C000
stack
page read and write
2D4E000
stack
page read and write
B78000
unkown
page execute and read and write
ED0000
heap
page read and write
283E000
stack
page read and write
6C555000
unkown
page readonly
6C50F000
unkown
page readonly
6C550000
unkown
page read and write
CC0000
heap
page read and write
400000
remote allocation
page execute and read and write
6C35E000
unkown
page read and write
4C4000
remote allocation
page execute and read and write
F5F000
stack
page read and write
BE0000
heap
page read and write
106C000
heap
page read and write
61ED4000
direct allocation
page readonly
6C371000
unkown
page execute read
59C000
remote allocation
page execute and read and write
A64000
unkown
page readonly
403000
unkown
page readonly
A20000
unkown
page readonly
A42000
unkown
page readonly
1A5DE000
stack
page read and write
1AA5E000
stack
page read and write
46A000
remote allocation
page execute and read and write
C5B000
stack
page read and write
2C00000
trusted library allocation
page read and write
6C54F000
unkown
page write copy
284E000
heap
page read and write
122E000
stack
page read and write
27380000
heap
page read and write
F40000
heap
page read and write
2C40000
heap
page execute and read and write
2930000
heap
page read and write
61EB7000
direct allocation
page readonly
B5D000
unkown
page readonly
2B80000
trusted library allocation
page execute and read and write
6C34D000
unkown
page readonly
2D51000
trusted library allocation
page read and write
1060000
heap
page read and write
400000
unkown
page readonly
10F8000
heap
page read and write
DD5000
heap
page read and write
5B4000
unkown
page execute and read and write
212F0000
heap
page read and write
21348000
heap
page read and write
3D55000
trusted library allocation
page read and write
401000
unkown
page execute and write copy
10FF000
stack
page read and write
2B90000
heap
page read and write
273A1000
heap
page read and write
2D90E000
stack
page read and write
61ED0000
direct allocation
page read and write
2920000
heap
page read and write
61E00000
direct allocation
page execute and read and write
401000
unkown
page execute read
2AD0000
trusted library allocation
page read and write
5B4000
unkown
page execute and read and write
D80000
heap
page read and write
F0A000
heap
page read and write
2AF4000
trusted library allocation
page read and write
F3A000
heap
page read and write
111C000
heap
page read and write
AFC000
stack
page read and write
1B20F000
stack
page read and write
1AB5F000
stack
page read and write
BF0000
heap
page read and write
2B17000
trusted library allocation
page execute and read and write
1B280000
heap
page read and write
9C000
stack
page read and write
F1D000
heap
page read and write
B79000
unkown
page write copy
132F000
stack
page read and write
21337000
heap
page read and write
BE0000
heap
page read and write
B78000
unkown
page execute and write copy
193000
stack
page read and write
493000
remote allocation
page execute and read and write
E60000
heap
page read and write
2B10000
trusted library allocation
page read and write
400000
unkown
page readonly
D80000
heap
page read and write
405000
unkown
page execute read
6C370000
unkown
page readonly
2AF0000
trusted library allocation
page read and write
2BB0000
heap
page read and write
F0A000
heap
page read and write
21300000
heap
page read and write
3D51000
trusted library allocation
page read and write
A42000
unkown
page readonly
6C362000
unkown
page readonly
6C2D1000
unkown
page execute read
1B10E000
stack
page read and write
2DA0E000
stack
page read and write
2B30000
trusted library allocation
page read and write
61EB4000
direct allocation
page read and write
D0E000
stack
page read and write
B79000
unkown
page write copy
1A6DE000
stack
page read and write
21320000
heap
page read and write
F95000
heap
page read and write
62C000
remote allocation
page execute and read and write
212F2000
heap
page read and write
F00000
heap
page read and write
61ECC000
direct allocation
page read and write
2D57000
trusted library allocation
page execute and read and write
B78000
unkown
page execute and read and write
403000
unkown
page readonly
DB0000
heap
page read and write
193000
stack
page read and write
63E000
remote allocation
page execute and read and write
1040000
heap
page read and write
2D6FF000
stack
page read and write
2AE3000
trusted library allocation
page execute and read and write
DD0000
heap
page read and write
583000
remote allocation
page execute and read and write
2D8CC000
stack
page read and write
1AB9D000
stack
page read and write
2D7CC000
stack
page read and write
2BFD000
stack
page read and write
B78000
unkown
page execute and write copy
405000
unkown
page execute read
1AF5F000
stack
page read and write
C0E000
heap
page read and write
10FE000
heap
page read and write
43C000
remote allocation
page execute and read and write
273E000
stack
page read and write
61E01000
direct allocation
page execute read
27360000
heap
page read and write
213F4000
heap
page read and write
F0D000
heap
page read and write
4FD000
remote allocation
page execute and read and write
404000
unkown
page execute and read and write
10D0000
heap
page read and write
2E1A0000
heap
page read and write
B5D000
unkown
page readonly
275F0000
heap
page read and write
D4E000
stack
page read and write
111A000
heap
page read and write
1AE5E000
stack
page read and write
There are 176 hidden memdumps, click here to show them.