IOC Report
JFFjXW16yR.exe

loading gif

Files

File Path
Type
Category
Malicious
JFFjXW16yR.exe
PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\JFFjXW16yR.exe.log
CSV text
dropped
 malicious
C:\Users\user\AppData\Local\Temp\tmp18BD.tmp.dat
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Local\Temp\tmp18ED.tmp.dat
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Templates\loginFile.db
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\JFFjXW16yR.exe
"C:\Users\user\Desktop\JFFjXW16yR.exe"
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

URLs

Name
IP
Malicious
https://api.telegram.org
unknown
 malicious
https://api.telegram.org/bot
unknown
 malicious
https://api.telegram.org/bot7487818328:AAGmIqXHljqLNUPxdc-QpOwPXooEPkvNg5U/sendDocument?chat_id=6333631912&caption=??%20OC%20verison%20-%20Microsoft%20Windows%20NT%206.2.9200.0%0AMachineName%20-%20767668/user%0ACurrent%20time%20-%2008/10/2024%2007:52:00
149.154.167.220
https://api.telegram.org/bot7487818328:AAGmIqXHljqLNUPxdc-QpOwPXooEPkvNg5U/sendDocument?chat_id=6333
unknown
http://api.telegram.org
unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
unknown
https://api.telegram.org/botE7487818328:AAGmIqXHljqLNUPxdc-QpOwPXooEPkvNg5UF/sendDocument?chat_id=G6
unknown

Domains

Name
IP
Malicious
api.telegram.org
149.154.167.220
 malicious

IPs

IP
Domain
Country
Malicious
149.154.167.220
api.telegram.org
United Kingdom
malicious

Registry

Path
Value
Malicious
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JFFjXW16yR_RASAPI32
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JFFjXW16yR_RASAPI32
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JFFjXW16yR_RASAPI32
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JFFjXW16yR_RASAPI32
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JFFjXW16yR_RASAPI32
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JFFjXW16yR_RASAPI32
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JFFjXW16yR_RASAPI32
FileDirectory
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JFFjXW16yR_RASMANCS
EnableFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JFFjXW16yR_RASMANCS
EnableAutoFileTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JFFjXW16yR_RASMANCS
EnableConsoleTracing
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JFFjXW16yR_RASMANCS
FileTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JFFjXW16yR_RASMANCS
ConsoleTracingMask
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JFFjXW16yR_RASMANCS
MaxFileSize
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\JFFjXW16yR_RASMANCS
FileDirectory
There are 4 hidden registries, click here to show them.

Memdumps

Base Address
Regiontype
Protect
Malicious
3421000
trusted library allocation
page read and write
 malicious
F02000
unkown
page readonly
 malicious
3552000
trusted library allocation
page read and write
 malicious
1BECE000
stack
page read and write
7FFD9B710000
trusted library allocation
page execute and read and write
36B4000
trusted library allocation
page read and write
16B5000
heap
page read and write
F00000
unkown
page readonly
7FFD9B663000
trusted library allocation
page read and write
3210000
heap
page read and write
315E000
stack
page read and write
3531000
trusted library allocation
page read and write
7FFD9B82D000
trusted library allocation
page read and write
1BDC0000
heap
page execute and read and write
1493000
heap
page read and write
7FFD9B820000
trusted library allocation
page read and write
F64000
unkown
page readonly
1450000
heap
page read and write
3658000
trusted library allocation
page read and write
1C60D000
stack
page read and write
13F0000
heap
page read and write
147A000
heap
page read and write
7FFD9B670000
trusted library allocation
page read and write
1BCDF000
stack
page read and write
F00000
unkown
page readonly
7FFD9B67D000
trusted library allocation
page execute and read and write
3663000
trusted library allocation
page read and write
1BFDA000
heap
page read and write
7FFD9B650000
trusted library allocation
page read and write
7FFD9B800000
trusted library allocation
page execute and read and write
14C0000
heap
page read and write
17BE000
stack
page read and write
7FFD9B870000
trusted library allocation
page execute and read and write
13421000
trusted library allocation
page read and write
7FFD9B66D000
trusted library allocation
page execute and read and write
14D7000
heap
page read and write
1456000
heap
page read and write
14C4000
heap
page read and write
7FFD9B700000
trusted library allocation
page read and write
3655000
trusted library allocation
page read and write
FF0000
heap
page read and write
164E000
stack
page read and write
7FF42F990000
trusted library allocation
page execute and read and write
1420000
heap
page read and write
12E3000
stack
page read and write
7FFD9B736000
trusted library allocation
page execute and read and write
1410000
heap
page read and write
354C000
trusted library allocation
page read and write
7FFD9B770000
trusted library allocation
page execute and read and write
7FFD9B654000
trusted library allocation
page read and write
1BFCE000
stack
page read and write
1670000
trusted library allocation
page read and write
3679000
trusted library allocation
page read and write
1BFD0000
heap
page read and write
1690000
trusted library allocation
page read and write
7FFD9B706000
trusted library allocation
page read and write
3693000
trusted library allocation
page read and write
7FFD9B653000
trusted library allocation
page execute and read and write
1520000
heap
page read and write
7FFD9B67B000
trusted library allocation
page execute and read and write
352D000
trusted library allocation
page read and write
7FFD9B70C000
trusted library allocation
page execute and read and write
1C40E000
stack
page read and write
1B89C000
stack
page read and write
1C70F000
stack
page read and write
16B0000
heap
page read and write
36B8000
trusted library allocation
page read and write
1C029000
heap
page read and write
7FFD9B850000
trusted library allocation
page read and write
1504000
heap
page read and write
1490000
heap
page read and write
1415000
heap
page read and write
7FFD9B65D000
trusted library allocation
page execute and read and write
3410000
heap
page execute and read and write
7FFD9B810000
trusted library allocation
page read and write
7FFD9B840000
trusted library allocation
page read and write
7FFD9B652000
trusted library allocation
page read and write
7FFD9B830000
trusted library allocation
page read and write
1342B000
trusted library allocation
page read and write
13D0000
heap
page read and write
1534000
heap
page read and write
1C30E000
stack
page read and write
7FFD9B7F0000
trusted library allocation
page read and write
1C50E000
stack
page read and write
145C000
heap
page read and write
36BC000
trusted library allocation
page read and write
18BE000
stack
page read and write
36A6000
trusted library allocation
page read and write
7FFD9B860000
trusted library allocation
page read and write
7FFD9B6AC000
trusted library allocation
page execute and read and write
7FFD9B674000
trusted library allocation
page read and write
There are 81 hidden memdumps, click here to show them.