IOC Report
08(2)_00.exe

loading gif

Files

File Path
Type
Category
Malicious
08(2)_00.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\08(2)_00.exe.log
ASCII text, with CRLF line terminators
dropped
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fOLFRQq.exe.log
ASCII text, with CRLF line terminators
modified
C:\Users\user\AppData\Roaming\fOLFRQq\fOLFRQq.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
C:\Users\user\AppData\Roaming\lqadtknr.kra\Chrome\Default\Network\Cookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
dropped
C:\Users\user\AppData\Roaming\lqadtknr.kra\Edge Chromium\Default\Network\Cookies
SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
dropped
C:\Users\user\AppData\Roaming\lqadtknr.kra\Firefox\Profiles\24a4ohrz.default-release\cookies.sqlite
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
modified
\Device\ConDrv
ASCII text, with CRLF line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\08(2)_00.exe
"C:\Users\user\Desktop\08(2)_00.exe"
 malicious
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
 malicious
C:\Users\user\AppData\Roaming\fOLFRQq\fOLFRQq.exe
"C:\Users\user\AppData\Roaming\fOLFRQq\fOLFRQq.exe"
malicious
C:\Users\user\AppData\Roaming\fOLFRQq\fOLFRQq.exe
"C:\Users\user\AppData\Roaming\fOLFRQq\fOLFRQq.exe"
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://api.telegram
unknown
 malicious
https://api.telegram.org/bot5556229164:AAG06WuQ2Ibcy5ZKb4lTSDlmionK0lTPWiM/sendDocument
149.154.167.220
 malicious
https://api.ipify.org
unknown
 malicious
https://api.telegram.org
unknown
 malicious
https://api.telegram.org/bot5556229164:AAG06WuQ2Ibcy5ZKb4lTSDlmionK0lTPWiM/
unknown
 malicious
https://api.ipify.org/
104.26.12.205
http://api.telegram.org
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://notify-api.line.me/api/notify
unknown
https://github.com/WindOfNet/CgLogListener
unknown
https://api.telegram.orgLJK
unknown
There are 1 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
api.ipify.org
104.26.12.205
 malicious
api.telegram.org
149.154.167.220
 malicious

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
malicious
104.26.12.205
api.ipify.org
United States
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegAsm_RASMANCS
FileDirectory
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
fOLFRQq
There are 6 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
4319000
trusted library allocation
page read and write
 malicious
402000
remote allocation
page execute and read and write
 malicious
30E7000
trusted library allocation
page read and write
 malicious
15E1000
heap
page read and write
5836000
trusted library allocation
page read and write
3100000
heap
page read and write
3300000
heap
page read and write
3198000
trusted library allocation
page read and write
12F9000
stack
page read and write
32B0000
heap
page read and write
67C000
stack
page read and write
57A0000
heap
page read and write
139D000
heap
page read and write
5B80000
trusted library allocation
page read and write
650D000
unkown
page read and write
5540000
trusted library allocation
page execute and read and write
14D4000
trusted library allocation
page read and write
329E000
stack
page read and write
79FB000
heap
page read and write
14E4000
trusted library allocation
page read and write
7F0000
heap
page read and write
147E000
stack
page read and write
32F7000
trusted library allocation
page read and write
16CE000
stack
page read and write
55CA000
heap
page read and write
7930000
heap
page read and write
6F90000
trusted library allocation
page read and write
3671000
trusted library allocation
page read and write
5851000
trusted library allocation
page read and write
5750000
heap
page execute and read and write
79F7000
heap
page read and write
14A0000
trusted library allocation
page execute and read and write
974000
heap
page read and write
680E000
stack
page read and write
5BF0000
trusted library allocation
page execute and read and write
3D2000
unkown
page readonly
1440000
trusted library allocation
page read and write
1530000
trusted library allocation
page read and write
32A0000
trusted library allocation
page execute and read and write
7350000
trusted library allocation
page read and write
4257000
trusted library allocation
page read and write
316C000
trusted library allocation
page read and write
1782000
trusted library allocation
page read and write
3287000
trusted library allocation
page read and write
FB0000
heap
page read and write
1510000
heap
page read and write
3178000
trusted library allocation
page read and write
732D000
trusted library allocation
page read and write
7F0D0000
trusted library allocation
page execute and read and write
976000
heap
page read and write
5859000
trusted library allocation
page read and write
5680000
trusted library allocation
page read and write
332E000
trusted library allocation
page read and write
63CD000
heap
page read and write
66CE000
stack
page read and write
6337000
heap
page read and write
950000
heap
page read and write
3188000
trusted library allocation
page read and write
579E000
stack
page read and write
1710000
heap
page read and write
8A40000
heap
page read and write
D40000
heap
page read and write
5CED000
stack
page read and write
264E000
stack
page read and write
2FA0000
heap
page read and write
5D30000
heap
page read and write
539E000
stack
page read and write
5651000
trusted library allocation
page read and write
484D000
stack
page read and write
560C000
stack
page read and write
6FA0000
trusted library allocation
page execute and read and write
6C8F000
stack
page read and write
15EA000
heap
page read and write
318C000
trusted library allocation
page read and write
32FC000
trusted library allocation
page read and write
BFB000
trusted library allocation
page execute and read and write
8A30000
heap
page read and write
3D0000
unkown
page readonly
14BE000
stack
page read and write
1588000
heap
page read and write
13B0000
trusted library allocation
page read and write
1433000
trusted library allocation
page execute and read and write
7370000
trusted library allocation
page execute and read and write
1480000
trusted library allocation
page read and write
1452000
trusted library allocation
page read and write
728D000
stack
page read and write
3447000
trusted library allocation
page read and write
FFC000
stack
page read and write
90D000
stack
page read and write
5670000
trusted library allocation
page read and write
7340000
trusted library allocation
page read and write
177A000
trusted library allocation
page execute and read and write
32D0000
heap
page execute and read and write
584E000
trusted library allocation
page read and write
5B90000
trusted library section
page read and write
168C000
stack
page read and write
3168000
trusted library allocation
page read and write
563B000
trusted library allocation
page read and write
2F60000
heap
page read and write
1210000
heap
page read and write
583B000
trusted library allocation
page read and write
FDC000
stack
page read and write
58F0000
trusted library allocation
page read and write
2F90000
trusted library allocation
page read and write
5BA0000
trusted library allocation
page read and write
5865000
trusted library allocation
page read and write
958000
heap
page read and write
96F000
heap
page read and write
1780000
trusted library allocation
page read and write
7D5000
heap
page read and write
7323000
trusted library allocation
page read and write
5870000
trusted library allocation
page read and write
553B000
stack
page read and write
1350000
heap
page read and write
5900000
trusted library allocation
page read and write
8A06000
trusted library allocation
page read and write
4396000
trusted library allocation
page read and write
79A3000
heap
page read and write
72E0000
heap
page read and write
1456000
trusted library allocation
page execute and read and write
14CF000
stack
page read and write
559B000
stack
page read and write
143D000
trusted library allocation
page execute and read and write
5674000
trusted library allocation
page read and write
8A09000
trusted library allocation
page read and write
54EE000
stack
page read and write
EAC000
stack
page read and write
63C7000
heap
page read and write
F02000
unkown
page readonly
1450000
trusted library allocation
page read and write
132E000
stack
page read and write
B50000
heap
page read and write
1760000
trusted library allocation
page read and write
2530000
trusted library allocation
page read and write
13B3000
heap
page read and write
42A1000
trusted library allocation
page read and write
63D8000
heap
page read and write
F80000
heap
page read and write
14B5000
heap
page read and write
5834000
trusted library allocation
page read and write
72F2000
trusted library allocation
page read and write
7300000
trusted library allocation
page execute and read and write
BB0000
trusted library allocation
page read and write
4317000
trusted library allocation
page read and write
3201000
trusted library allocation
page read and write
5753000
heap
page execute and read and write
32E0000
trusted library allocation
page read and write
174D000
trusted library allocation
page execute and read and write
7957000
heap
page read and write
40B1000
trusted library allocation
page read and write
BD0000
trusted library allocation
page read and write
6310000
heap
page read and write
6C4E000
stack
page read and write
6A70000
trusted library allocation
page read and write
5662000
trusted library allocation
page read and write
317C000
trusted library allocation
page read and write
1744000
trusted library allocation
page read and write
2F80000
trusted library allocation
page read and write
5642000
trusted library allocation
page read and write
7969000
heap
page read and write
17C0000
trusted library allocation
page execute and read and write
63B0000
heap
page read and write
6403000
heap
page read and write
15B6000
heap
page read and write
4297000
trusted library allocation
page read and write
58C0000
trusted library allocation
page read and write
17D0000
heap
page read and write
F00000
unkown
page readonly
319E000
stack
page read and write
31FB000
trusted library allocation
page read and write
14B0000
heap
page read and write
6342000
heap
page read and write
14D8000
heap
page read and write
17A0000
heap
page read and write
5D40000
trusted library section
page read and write
310F000
trusted library allocation
page read and write
53ED000
stack
page read and write
640E000
heap
page read and write
72D0000
heap
page read and write
1580000
heap
page read and write
1434000
trusted library allocation
page read and write
5910000
trusted library allocation
page execute and read and write
3170000
trusted library allocation
page read and write
633B000
heap
page read and write
4217000
trusted library allocation
page read and write
159F000
heap
page read and write
564E000
trusted library allocation
page read and write
72F0000
trusted library allocation
page read and write
7240000
heap
page execute and read and write
252E000
stack
page read and write
136E000
stack
page read and write
6394000
heap
page read and write
15C7000
heap
page read and write
5890000
trusted library allocation
page read and write
1743000
trusted library allocation
page execute and read and write
14D3000
trusted library allocation
page execute and read and write
1787000
trusted library allocation
page execute and read and write
FAA000
stack
page read and write
696E000
stack
page read and write
1717000
heap
page read and write
FB6000
heap
page read and write
54F0000
trusted library allocation
page read and write
7318000
trusted library allocation
page read and write
B4F000
stack
page read and write
30B1000
trusted library allocation
page read and write
1370000
heap
page read and write
1763000
trusted library allocation
page read and write
3304000
trusted library allocation
page read and write
474D000
stack
page read and write
1776000
trusted library allocation
page execute and read and write
563E000
trusted library allocation
page read and write
3184000
trusted library allocation
page read and write
31BF000
trusted library allocation
page read and write
5840000
trusted library allocation
page read and write
63E9000
heap
page read and write
1420000
trusted library allocation
page read and write
30A0000
trusted library allocation
page read and write
BF7000
trusted library allocation
page execute and read and write
17BD000
stack
page read and write
9AE000
heap
page read and write
714C000
stack
page read and write
14E0000
trusted library allocation
page read and write
1500000
trusted library allocation
page read and write
797E000
heap
page read and write
1507000
trusted library allocation
page execute and read and write
3174000
trusted library allocation
page read and write
55C0000
heap
page read and write
42D7000
trusted library allocation
page read and write
19AF000
stack
page read and write
13C5000
heap
page read and write
1430000
trusted library allocation
page read and write
573E000
stack
page read and write
177F000
stack
page read and write
400000
remote allocation
page execute and read and write
3194000
trusted library allocation
page read and write
5BEE000
stack
page read and write
79CD000
heap
page read and write
BD4000
trusted library allocation
page read and write
1462000
trusted library allocation
page read and write
D30000
trusted library allocation
page execute and read and write
1770000
trusted library allocation
page read and write
31AF000
trusted library allocation
page read and write
BC3000
trusted library allocation
page execute and read and write
97B000
heap
page read and write
150B000
trusted library allocation
page execute and read and write
2671000
trusted library allocation
page read and write
32A1000
trusted library allocation
page read and write
13A4000
heap
page read and write
7343000
trusted library allocation
page read and write
1467000
trusted library allocation
page execute and read and write
5832000
trusted library allocation
page read and write
41D5000
trusted library allocation
page read and write
1460000
trusted library allocation
page read and write
5630000
trusted library allocation
page read and write
144D000
trusted library allocation
page execute and read and write
79B6000
heap
page read and write
145A000
trusted library allocation
page execute and read and write
7830000
heap
page read and write
C10000
heap
page read and write
7480000
heap
page read and write
1465000
trusted library allocation
page execute and read and write
309F000
stack
page read and write
16CF000
stack
page read and write
6A6F000
stack
page read and write
30AE000
stack
page read and write
63ED000
heap
page read and write
5D3F000
stack
page read and write
79A7000
heap
page read and write
63FF000
heap
page read and write
176D000
trusted library allocation
page execute and read and write
15A4000
heap
page read and write
18AE000
stack
page read and write
7310000
trusted library allocation
page read and write
178B000
trusted library allocation
page execute and read and write
F70000
heap
page read and write
2EC8000
trusted library allocation
page read and write
170E000
stack
page read and write
6390000
heap
page read and write
12F7000
stack
page read and write
6F16000
trusted library allocation
page read and write
6330000
heap
page read and write
7390000
trusted library section
page read and write
1785000
trusted library allocation
page execute and read and write
15AA000
heap
page read and write
57A4000
heap
page read and write
6F10000
trusted library allocation
page read and write
4315000
trusted library allocation
page read and write
1566000
heap
page read and write
5885000
trusted library allocation
page read and write
6B0C000
stack
page read and write
4195000
trusted library allocation
page read and write
5D40000
trusted library allocation
page read and write
690E000
stack
page read and write
1740000
trusted library allocation
page read and write
51AD000
stack
page read and write
14DE000
heap
page read and write
58D0000
trusted library allocation
page read and write
2660000
heap
page execute and read and write
40DA000
trusted library allocation
page read and write
794C000
heap
page read and write
988000
heap
page read and write
5AAC000
stack
page read and write
4136000
trusted library allocation
page read and write
588A000
trusted library allocation
page read and write
9B2000
heap
page read and write
5C00000
trusted library allocation
page execute and read and write
79D7000
heap
page read and write
14D0000
heap
page read and write
7997000
heap
page read and write
5656000
trusted library allocation
page read and write
13C0000
heap
page read and write
13E8000
heap
page read and write
5C30000
heap
page execute and read and write
1354000
heap
page read and write
3180000
trusted library allocation
page read and write
7993000
heap
page read and write
1329000
heap
page read and write
157E000
stack
page read and write
1340000
heap
page read and write
3200000
heap
page execute and read and write
3290000
heap
page execute and read and write
1730000
trusted library allocation
page read and write
3158000
trusted library allocation
page read and write
F0A000
stack
page read and write
58B0000
trusted library allocation
page read and write
565D000
trusted library allocation
page read and write
58AC000
stack
page read and write
6405000
heap
page read and write
63F3000
heap
page read and write
56DC000
stack
page read and write
7B30000
trusted library allocation
page read and write
779000
stack
page read and write
6314000
heap
page read and write
146B000
trusted library allocation
page execute and read and write
1490000
heap
page execute and read and write
4BF0000
heap
page execute and read and write
BCD000
trusted library allocation
page execute and read and write
B70000
heap
page read and write
170C000
stack
page read and write
9B5000
heap
page read and write
6F5C000
stack
page read and write
1750000
heap
page read and write
5844000
trusted library allocation
page read and write
58C3000
trusted library allocation
page read and write
63E2000
heap
page read and write
1360000
heap
page read and write
3190000
trusted library allocation
page read and write
59AE000
stack
page read and write
14DD000
trusted library allocation
page execute and read and write
6F80000
trusted library allocation
page read and write
58E0000
trusted library allocation
page execute and read and write
31C1000
trusted library allocation
page read and write
1345000
heap
page read and write
8A0E000
trusted library allocation
page read and write
734A000
trusted library allocation
page read and write
32F0000
trusted library allocation
page read and write
6409000
heap
page read and write
1320000
heap
page read and write
BC4000
trusted library allocation
page read and write
67CF000
stack
page read and write
4356000
trusted library allocation
page read and write
5880000
trusted library allocation
page read and write
1512000
heap
page read and write
793C000
heap
page read and write
3311000
trusted library allocation
page read and write
3318000
trusted library allocation
page read and write
7D0000
heap
page read and write
6C0C000
stack
page read and write
17F0000
heap
page read and write
3DE000
unkown
page readonly
135D000
heap
page read and write
94E000
stack
page read and write
4311000
trusted library allocation
page read and write
1772000
trusted library allocation
page read and write
5856000
trusted library allocation
page read and write
3150000
trusted library allocation
page read and write
D1E000
stack
page read and write
5BAE000
stack
page read and write
1430000
heap
page read and write
3500000
trusted library allocation
page read and write
2540000
heap
page read and write
72CE000
stack
page read and write
5879000
trusted library allocation
page read and write
63F8000
heap
page read and write
There are 374 hidden memdumps, click here to show them.