IOC Report
file.exe

loading gif

Files

File Path
Type
Category
Malicious
file.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\AppData\Local\Temp\delays.tmp
ISO-8859 text, with very long lines (65536), with no line terminators
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\file.exe
"C:\Users\user\Desktop\file.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\FCAKFCGCGIEG" & exit
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\timeout.exe
timeout /t 10

URLs

Name
IP
Malicious
https://b2een.xyz/sqlite3.dll
49.13.32.95
 malicious
https://b2een.xyz/
49.13.32.95
 malicious
https://t.me/
unknown
https://web.telegram.org
unknown
https://t.me/fu4chmof
unknown
https://t.me/fu4chmor08etMozilla/5.0
unknown
https://steamcommunity.com/profiles/76561199802540894
https://b2een.xyzHJJJJKEG
unknown
https://t.me/O
unknown
https://steamcommunity.com/profiles/76561199802540894r08etMozilla/5.0
unknown
https://b2een.xyz/bi
unknown
https://t.me/fu4chmo338
unknown
https://b2een.xyztosh;
unknown
https://b2een.xyz
unknown
https://t.me/fu4chmo
149.154.167.99
There are 5 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
b2een.xyz
49.13.32.95
 malicious
t.me
149.154.167.99

IPs

IP
Domain
Country
Malicious
49.13.32.95
b2een.xyz
Germany
malicious
149.154.167.99
t.me
United Kingdom

Registry

Path
Value
Malicious
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214EF-0000-0000-C000-000000000046} 0xFFFF

Memdumps

Base Address
Regiontype
Protect
Malicious
D81000
unkown
page readonly
 malicious
DF8000
unkown
page read and write
 malicious
D81000
unkown
page readonly
 malicious
D50000
unkown
page readonly
FA3000
unkown
page readonly
C5E000
stack
page read and write
12DCF000
stack
page read and write
365B000
heap
page read and write
7DE000
stack
page read and write
A4CE000
stack
page read and write
DF2000
unkown
page read and write
3595000
heap
page read and write
210A8000
heap
page read and write
D51000
unkown
page execute and write copy
35E1000
heap
page read and write
D8E000
unkown
page write copy
35EB000
heap
page read and write
1C3A0000
remote allocation
page read and write
211C0000
heap
page read and write
3618000
heap
page read and write
35DA000
heap
page read and write
3590000
heap
page read and write
34E2000
stack
page read and write
DB4000
unkown
page read and write
660000
heap
page read and write
35D7000
heap
page read and write
210B8000
heap
page read and write
7F8E000
stack
page read and write
D1E000
stack
page read and write
E36000
unkown
page read and write
35F7000
heap
page read and write
178CE000
stack
page read and write
19E4B000
stack
page read and write
3606000
heap
page read and write
211CA000
heap
page read and write
FA3000
unkown
page readonly
35FE000
heap
page read and write
2148B000
stack
page read and write
F91000
unkown
page read and write
3607000
heap
page read and write
35CF000
heap
page read and write
4420000
heap
page read and write
1C3A0000
remote allocation
page read and write
19E0C000
stack
page read and write
3618000
heap
page read and write
680000
heap
page read and write
3605000
heap
page read and write
EEA000
unkown
page read and write
1E930000
heap
page read and write
35CD000
heap
page read and write
34DE000
stack
page read and write
210A5000
heap
page read and write
21040000
trusted library allocation
page read and write
7AE000
stack
page read and write
670000
heap
page read and write
35DA000
heap
page read and write
36B0000
heap
page read and write
235C0000
heap
page read and write
3609000
heap
page read and write
3AC000
stack
page read and write
1E98B000
stack
page read and write
34DC000
stack
page read and write
3605000
heap
page read and write
3605000
heap
page read and write
917000
heap
page read and write
3EC000
stack
page read and write
C9E000
stack
page read and write
8CF000
stack
page read and write
1788D000
stack
page read and write
35D6000
heap
page read and write
35D8000
heap
page read and write
35D6000
heap
page read and write
35D8000
heap
page read and write
1C3A0000
remote allocation
page read and write
21140000
trusted library allocation
page read and write
685000
heap
page read and write
1C3DE000
stack
page read and write
20F41000
heap
page read and write
88E000
stack
page read and write
DDD000
unkown
page read and write
20F30000
heap
page read and write
20F41000
heap
page read and write
880000
heap
page read and write
21751000
heap
page read and write
357E000
heap
page read and write
D50000
unkown
page readonly
3615000
heap
page read and write
35D0000
heap
page read and write
35DA000
heap
page read and write
3614000
heap
page read and write
35D6000
heap
page read and write
DEF000
unkown
page read and write
7C0000
heap
page read and write
3603000
heap
page read and write
88B000
heap
page read and write
E34F000
stack
page read and write
CDE000
stack
page read and write
35DA000
heap
page read and write
88E000
heap
page read and write
3605000
heap
page read and write
21040000
heap
page read and write
3666000
heap
page read and write
3595000
heap
page read and write
2BA5C000
stack
page read and write
35DA000
heap
page read and write
35FE000
heap
page read and write
883000
heap
page read and write
35D6000
heap
page read and write
D8E000
unkown
page write copy
3618000
heap
page read and write
1088F000
stack
page read and write
35DA000
heap
page read and write
3614000
heap
page read and write
80E000
stack
page read and write
3602000
heap
page read and write
687000
heap
page read and write
687000
heap
page read and write
3589000
heap
page read and write
35DA000
heap
page read and write
35D8000
heap
page read and write
810000
heap
page read and write
3602000
heap
page read and write
63C000
stack
page read and write
1534E000
stack
page read and write
35FF000
heap
page read and write
76E000
stack
page read and write
3564000
heap
page read and write
35DA000
heap
page read and write
369C000
heap
page read and write
650000
heap
page read and write
351E000
heap
page read and write
20ECA000
stack
page read and write
351A000
heap
page read and write
35FE000
heap
page read and write
3605000
heap
page read and write
20F40000
heap
page read and write
910000
heap
page read and write
3610000
heap
page read and write
3603000
heap
page read and write
35FE000
heap
page read and write
3608000
heap
page read and write
34EC000
stack
page read and write
35FA000
heap
page read and write
7B0000
heap
page read and write
358C000
heap
page read and write
3605000
heap
page read and write
35CF000
heap
page read and write
3618000
heap
page read and write
79E000
stack
page read and write
3605000
heap
page read and write
3614000
heap
page read and write
84E000
stack
page read and write
3510000
heap
page read and write
1C38C000
stack
page read and write
35DA000
heap
page read and write
3590000
heap
page read and write
3605000
heap
page read and write
1E91F000
stack
page read and write
1530F000
stack
page read and write
360A000
heap
page read and write
D51000
unkown
page execute and write copy
35F2000
heap
page read and write
36D8000
heap
page read and write
3610000
heap
page read and write
There are 154 hidden memdumps, click here to show them.