IOC Report
b123.exe

loading gif

Files

File Path
Type
Category
Malicious
b123.exe
PE32 executable (GUI) Intel 80386, for MS Windows
initial sample
 malicious
C:\Users\user\Desktop\4OZ5FKFU
SQLite 3.x database, last written using SQLite version 3032001
dropped
C:\Users\user\Desktop\GLFUAS2V
SQLite 3.x database, last written using SQLite version 3032001
dropped
C:\Users\user\Desktop\I5PPP8YC
SQLite 3.x database, last written using SQLite version 3032001
dropped
C:\Users\user\Desktop\M790ZMO8
SQLite 3.x database, last written using SQLite version 3032001
dropped

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\b123.exe
"C:\Users\user\Desktop\b123.exe"
malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\b123.exe" & exit
 malicious
C:\Windows\System32\conhost.exe
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
C:\Windows\SysWOW64\timeout.exe
timeout /t 5

URLs

Name
IP
Malicious
http://sughicent.com/blaka.php
5.63.155.126
 malicious
http://sughicent.com/request
5.63.155.126
 malicious
https://ac.ecosia.org/autocomplete?q=
unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
unknown
https://duckduckgo.com/chrome_newtab
unknown
https://duckduckgo.com/ac/?q=
unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico
unknown
http://ocsp.sectigo.com0
unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
unknown
https://sectigo.com/CPS0D
unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
unknown
There are 4 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
sughicent.com
5.63.155.126
 malicious

IPs

IP
Domain
Country
Malicious
5.63.155.126
sughicent.com
Russian Federation
malicious

Memdumps

Base Address
Regiontype
Protect
Malicious
2070000
direct allocation
page execute and read and write
 malicious
5DA000
heap
page read and write
 malicious
211E000
stack
page read and write
20A0000
heap
page read and write
20A8000
heap
page read and write
B9C6BCE000
stack
page read and write
32F0000
heap
page read and write
2A3B845F000
heap
page read and write
9C000
stack
page read and write
F104000
trusted library allocation
page read and write
F4D3000
trusted library allocation
page read and write
4CC0000
heap
page read and write
B9C747E000
stack
page read and write
6097A000
direct allocation
page read and write
FB6C000
stack
page read and write
2A3B8456000
heap
page read and write
2A3B8502000
heap
page read and write
8EA0000
heap
page read and write
60900000
direct allocation
page execute and read and write
8E8F000
stack
page read and write
2F9C000
stack
page read and write
7CF000
stack
page read and write
60980000
direct allocation
page readonly
20B0000
direct allocation
page execute and read and write
919E000
trusted library allocation
page read and write
FB3A000
heap
page read and write
18C000
stack
page read and write
337F000
stack
page read and write
F392000
trusted library allocation
page read and write
109BC000
stack
page read and write
6096F000
direct allocation
page readonly
6096E000
direct allocation
page read and write
333E000
stack
page read and write
198000
stack
page read and write
B9C6E7E000
stack
page read and write
63A000
heap
page read and write
439000
unkown
page execute and read and write
4BE000
stack
page read and write
3407000
heap
page read and write
F2C0000
trusted library allocation
page read and write
2A3B8513000
heap
page read and write
33FF000
stack
page read and write
2A3B8455000
heap
page read and write
2A3B8480000
heap
page read and write
8ACF000
stack
page read and write
400000
unkown
page execute and read and write
F3C0000
trusted library allocation
page read and write
B9C7177000
stack
page read and write
4C0000
heap
page read and write
B9C727E000
stack
page read and write
2A3B8280000
heap
page read and write
8D8E000
stack
page read and write
F330000
trusted library allocation
page read and write
B9C737C000
stack
page read and write
8C4E000
stack
page read and write
2A3B8290000
heap
page read and write
2A3B8402000
heap
page read and write
F39B000
trusted library allocation
page read and write
19E000
stack
page read and write
8C0F000
stack
page read and write
6BD000
heap
page read and write
60901000
direct allocation
page execute read
30000
heap
page read and write
2A3B8426000
heap
page read and write
2A3B8466000
heap
page read and write
401000
unkown
page execute read
8FFA000
stack
page read and write
2A3B848B000
heap
page read and write
89CE000
stack
page read and write
2A3B845B000
heap
page read and write
3400000
heap
page read and write
2220000
unclassified section
page read and write
42F000
unkown
page write copy
10558000
trusted library allocation
page read and write
2A3B843C000
heap
page read and write
623000
heap
page read and write
32D0000
trusted library allocation
page read and write
8EFD000
stack
page read and write
FCB0000
trusted library allocation
page read and write
8D4F000
stack
page read and write
2A3B8413000
heap
page read and write
B9C707B000
stack
page read and write
648000
heap
page read and write
2A3B8500000
heap
page read and write
2A3B8453000
heap
page read and write
905E000
stack
page read and write
6097D000
direct allocation
page read and write
2A3B8429000
heap
page read and write
2A3B8508000
heap
page read and write
FBA0000
heap
page read and write
221F000
stack
page read and write
8CF000
stack
page read and write
108BE000
stack
page read and write
2A3B82F0000
heap
page read and write
2EF0000
heap
page read and write
400000
unkown
page readonly
FB30000
heap
page read and write
6097B000
direct allocation
page readonly
2A3B8C02000
trusted library allocation
page read and write
4C5000
heap
page read and write
6BA000
heap
page read and write
2A3B83F0000
trusted library allocation
page read and write
FCAA000
stack
page read and write
2A3B8400000
heap
page read and write
F38E000
trusted library allocation
page read and write
F9F4000
trusted library allocation
page read and write
2A3B8448000
heap
page read and write
196000
stack
page read and write
433000
unkown
page readonly
9010000
trusted library section
page readonly
B9C6B4B000
stack
page read and write
8B0E000
stack
page read and write
2A3B8461000
heap
page read and write
5D0000
heap
page read and write
10540000
trusted library allocation
page read and write
47E000
stack
page read and write
1F0000
trusted library allocation
page read and write
F4C0000
trusted library allocation
page read and write
33BE000
stack
page read and write
915E000
stack
page read and write
2F5C000
stack
page read and write
There are 111 hidden memdumps, click here to show them.