IOC Report
Vk2yYa9dHl.exe

loading gif

Files

File Path
Type
Category
Malicious
Vk2yYa9dHl.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
 malicious
C:\ProgramData\CBFBGCGI
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\DHJDAKEGDBFHCAAKJJJD
SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\FBGCAAAAFBKEBFHJEGCFCAAKEH
SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
dropped
C:\ProgramData\GIJKKKFC
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\IJDHDGDAAAAKFIDGHJDGCGCFHJ
SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
dropped
C:\ProgramData\KKEBKJJDGHCBGCAAKEHD
SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
dropped
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\msvcp140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\ProgramData\vcruntime140.dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\msvcp140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\vcruntime140[1].dll
PE32 executable (DLL) (console) Intel 80386, for MS Windows
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
data
dropped
C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
data
dropped
There are 11 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\Vk2yYa9dHl.exe
"C:\Users\user\Desktop\Vk2yYa9dHl.exe"
 malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\Vk2yYa9dHl.exe" & del "C:\ProgramData\*.dll"" & exit
malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\timeout.exe
timeout /t 5

URLs

Name
IP
Malicious
http://89.105.198.253/a50c1b38c13f8f79/nss3.dll
89.105.198.253
 malicious
http://89.105.198.253/a50c1b38c13f8f79/softokn3.dll
89.105.198.253
 malicious
http://89.105.198.253
unknown
 malicious
http://89.105.198.253/a50c1b38c13f8f79/freebl3.dll
89.105.198.253
 malicious
89.105.198.253/300e6d86f44da037.php
malicious
http://89.105.198.253/300e6d86f44da037.php
89.105.198.253
 malicious
http://89.105.198.253/a50c1b38c13f8f79/sqlite3.dll
89.105.198.253
 malicious
http://89.105.198.253/a50c1b38c13f8f79/mozglue.dll
89.105.198.253
 malicious
http://89.105.198.253/a50c1b38c13f8f79/msvcp140.dll
89.105.198.253
 malicious
http://89.105.198.253/a50c1b38c13f8f79/vcruntime140.dll
89.105.198.253
 malicious
https://cdn.epnacl
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
unknown
http://www.mozilla.com/en-US/blocklist/
unknown
https://duckduckgo.com/ac/?q=
unknown
https://mozilla.org0/
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
http://89.105.198.253/a50c1b38c13f8f79/sqlite3.dll)Yr?
unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
unknown
https://www.ecosia.org/newtab/
unknown
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
unknown
http://89.105.198.253/a50c1b38c13f8f79/msvcp140.dll%Vv
unknown
https://cdn.ep
unknown
https://ac.ecosia.org/autocomplete?q=
unknown
http://89.105.198.253/a50c1b38c13f8f79/nss3.dll-gD
unknown
http://89.105.198.253/300e6d86f44da037.php0//EN
unknown
http://89.105.198.253/a50c1b38c13f8f79/freebl3.dllSV
unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
unknown
https://support.mozilla.org
unknown
http://89.105.198.253/300e6d86f44da037.phpCoinomi
unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
http://89.105.198.253/300e6d86f44da037.php9
unknown
http://www.sqlite.org/copyright.html.
unknown
There are 28 hidden URLs, click here to show them.

IPs

IP
Domain
Country
Malicious
89.105.198.253
unknown
Netherlands
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
51000
unkown
page execute and write copy
 malicious
92E000
heap
page read and write
 malicious
51000
unkown
page execute and write copy
 malicious
750000
heap
page read and write
26CC0000
heap
page read and write
20C7D000
heap
page read and write
26FD2000
heap
page read and write
61ED3000
direct allocation
page read and write
20C70000
heap
page read and write
20C68000
heap
page read and write
20C79000
heap
page read and write
1A7BE000
stack
page read and write
2E8E000
stack
page read and write
C00000
heap
page read and write
2990000
heap
page read and write
2D17B000
stack
page read and write
98F000
heap
page read and write
61E01000
direct allocation
page execute read
26CFA000
heap
page read and write
274000
unkown
page read and write
20C79000
heap
page read and write
61EB7000
direct allocation
page readonly
B5E000
stack
page read and write
D0E000
stack
page read and write
20C70000
heap
page read and write
20D53000
heap
page read and write
20C8C000
heap
page read and write
1AA0D000
stack
page read and write
26D42000
heap
page read and write
50000
unkown
page readonly
1AA4D000
stack
page read and write
26D2C000
heap
page read and write
26FDA000
heap
page read and write
20C7D000
heap
page read and write
720000
heap
page read and write
20C6D000
heap
page read and write
2D240000
heap
page read and write
757000
heap
page read and write
20C68000
heap
page read and write
20C8C000
heap
page read and write
6CEFF000
unkown
page readonly
20C68000
heap
page read and write
286000
unkown
page readonly
8AE000
stack
page read and write
2D05B000
stack
page read and write
29FE000
stack
page read and write
26F2F000
stack
page read and write
26F6B000
stack
page read and write
20C56000
heap
page read and write
3CC000
stack
page read and write
2D34C000
stack
page read and write
26D83000
heap
page read and write
20C88000
heap
page read and write
4680000
heap
page read and write
2C40000
heap
page read and write
92A000
heap
page read and write
20C82000
heap
page read and write
20C79000
heap
page read and write
6CF40000
unkown
page read and write
6FD000
stack
page read and write
20C5C000
heap
page read and write
286000
unkown
page readonly
20C82000
heap
page read and write
26CF3000
heap
page read and write
26CE0000
heap
page read and write
20C82000
heap
page read and write
730000
heap
page read and write
B1E000
stack
page read and write
20C8A000
heap
page read and write
99000
unkown
page read and write
26D01000
heap
page read and write
26D2E000
heap
page read and write
2E4E000
stack
page read and write
6CD52000
unkown
page readonly
20C6D000
heap
page read and write
2980000
heap
page read and write
20C79000
heap
page read and write
900000
heap
page read and write
28B000
unkown
page write copy
20C83000
heap
page read and write
20C66000
heap
page read and write
28DC000
stack
page read and write
1AB4D000
stack
page read and write
6B000
unkown
page readonly
2C3F000
stack
page read and write
6CCC1000
unkown
page execute read
20C88000
heap
page read and write
1ABE0000
heap
page read and write
20C57000
heap
page read and write
86E000
stack
page read and write
1ABE1000
heap
page read and write
20C8A000
heap
page read and write
28B000
unkown
page write copy
20C57000
heap
page read and write
291C000
stack
page read and write
20C66000
heap
page read and write
20C56000
heap
page read and write
20C7D000
heap
page read and write
61ECC000
direct allocation
page read and write
A09000
heap
page read and write
6CCC0000
unkown
page readonly
20C6B000
heap
page read and write
6B000
unkown
page readonly
26E2E000
stack
page read and write
1A77E000
stack
page read and write
B9E000
stack
page read and write
20C82000
heap
page read and write
1ACE4000
heap
page read and write
6CD4E000
unkown
page read and write
20C68000
heap
page read and write
1A8BF000
stack
page read and write
1A57F000
stack
page read and write
61ECD000
direct allocation
page readonly
20C8C000
heap
page read and write
26FC8000
heap
page read and write
50000
unkown
page readonly
20C63000
heap
page read and write
20C56000
heap
page read and write
2C48000
heap
page read and write
20C69000
heap
page read and write
61ED4000
direct allocation
page readonly
BDE000
stack
page read and write
20C8C000
heap
page read and write
1A90D000
stack
page read and write
6CD61000
unkown
page execute read
20C6D000
heap
page read and write
A0E000
heap
page read and write
20C6D000
heap
page read and write
61E00000
direct allocation
page execute and read and write
6CD60000
unkown
page readonly
26D5C000
heap
page read and write
73000
unkown
page write copy
1ABD0000
heap
page read and write
20C68000
heap
page read and write
26D21000
heap
page read and write
198000
unkown
page read and write
26FC0000
heap
page read and write
1ACE0000
trusted library allocation
page read and write
61EB4000
direct allocation
page read and write
29B0000
heap
page read and write
20C70000
heap
page read and write
6CF3F000
unkown
page write copy
6CF3E000
unkown
page read and write
61ED0000
direct allocation
page read and write
73000
unkown
page write copy
20C8A000
heap
page read and write
26FCE000
heap
page read and write
974000
heap
page read and write
20C67000
heap
page read and write
20C68000
heap
page read and write
26D31000
heap
page read and write
20C63000
heap
page read and write
26CEE000
heap
page read and write
20C7D000
heap
page read and write
6CD3D000
unkown
page readonly
26CE7000
heap
page read and write
20C89000
heap
page read and write
26CE2000
heap
page read and write
C0B000
heap
page read and write
20C6D000
heap
page read and write
755000
heap
page read and write
20C56000
heap
page read and write
920000
heap
page read and write
20C64000
heap
page read and write
20C7D000
heap
page read and write
6F5000
stack
page read and write
20C79000
heap
page read and write
6CF45000
unkown
page readonly
1A67F000
stack
page read and write
20C89000
heap
page read and write
There are 160 hidden memdumps, click here to show them.