Cuckoo Sandbox

File 8a6309173bdf0748_aqkicausnk.exe

Summary
Download Resubmit sample

Size	361.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`6e4b57814b15abcdeff62d41e47c447c`
SHA1	`20f5185481a48f9b966ea1b022906b905e6d5597`
SHA256	`8a6309173bdf074800ede953c27d896cd3edb49c68972ca2faa1fa9d87b388c6`
SHA512	`67c929273a76dcce4536307354e33ffd4833be230d7dec5d46f8b2cfe0be642f9b360d28cd4a838f330a7cc9f2a24acb48b5d1057c1ed09af2d1fe66874c7124`
CRC32	`938F1855`
ssdeep	`None`
PDB Path	f:\è½¯ä»¶å·¥ç¨\é©±å¨ç¼ç¨\OK\KernelYK\bin\InstallSYS.pdb
Yara	vmdetect - Possibly employs anti-virtualization techniques anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process create_service - Create a windows service network_http - Communications over HTTP network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6574125

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis

Category	Started	Completed	Duration	Routing	Logs
FILE	June 27, 2025, 11:55 a.m.	June 27, 2025, 12:05 p.m.	592 seconds	internet	Show Analyzer Log Show Cuckoo Log

Analyzer Log

2025-06-22 02:00:20,000 [analyzer] DEBUG: Starting analyzer from: C:\tmp4hzt0l
2025-06-22 02:00:20,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\GEagzdePpcbPKoBPZEHOovPmj
2025-06-22 02:00:20,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\whkwNjAPvFSUevzGXKpjpcbeuZNmiYSD
2025-06-22 02:00:20,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-06-22 02:00:20,015 [analyzer] INFO: Automatically selected analysis package "exe"
2025-06-22 02:00:20,280 [analyzer] DEBUG: Started auxiliary module Curtain
2025-06-22 02:00:20,280 [analyzer] DEBUG: Started auxiliary module DbgView
2025-06-22 02:00:20,765 [analyzer] DEBUG: Started auxiliary module Disguise
2025-06-22 02:00:20,983 [analyzer] DEBUG: Loaded monitor into process with pid 504
2025-06-22 02:00:20,983 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-06-22 02:00:20,983 [analyzer] DEBUG: Started auxiliary module Human
2025-06-22 02:00:20,983 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-06-22 02:00:20,983 [analyzer] DEBUG: Started auxiliary module Reboot
2025-06-22 02:00:21,046 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-06-22 02:00:21,046 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-06-22 02:00:21,046 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-06-22 02:00:21,046 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-06-22 02:00:21,203 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\8a6309173bdf0748_aqkicausnk.exe' with arguments '' and pid 2548
2025-06-22 02:00:21,375 [analyzer] DEBUG: Loaded monitor into process with pid 2548
2025-06-22 02:00:21,890 [analyzer] INFO: Added new file to list with pid 2548 and path C:\Temp\CreateProcess.exe
2025-06-22 02:00:22,890 [analyzer] INFO: Added new file to list with pid 2548 and path C:\Temp\ljdbvtnlgdywqoig.exe
2025-06-22 02:00:22,953 [analyzer] INFO: Injected into process with pid 2912 and name u'ljdbvtnlgdywqoig.exe'
2025-06-22 02:00:23,078 [analyzer] INFO: Injected into process with pid 1568 and name u'iexplore.exe'
2025-06-22 02:00:23,125 [analyzer] DEBUG: Loaded monitor into process with pid 2912
2025-06-22 02:00:23,140 [analyzer] INFO: Added new file to list with pid 2912 and path \Device\NamedPipe\lsass
2025-06-22 02:00:23,312 [analyzer] DEBUG: Loaded monitor into process with pid 1568
2025-06-22 02:00:25,078 [analyzer] INFO: Added new file to list with pid 2548 and path C:\Temp\ljdbvtnlgdywqoig.sys
2025-06-22 02:00:25,203 [analyzer] INFO: Process with pid 2548 has terminated
2025-06-22 02:00:25,796 [analyzer] INFO: Added new file to list with pid 2912 and path C:\Temp\mhfzxrpjhc.exe
2025-06-22 02:00:25,937 [analyzer] INFO: Injected into process with pid 2844 and name u'CreateProcess.exe'
2025-06-22 02:00:26,092 [analyzer] DEBUG: Loaded monitor into process with pid 2844
2025-06-22 02:00:27,203 [analyzer] INFO: Process with pid 2844 has terminated
2025-06-22 02:00:28,453 [analyzer] INFO: Added new file to list with pid 2912 and path C:\Temp\i_mhfzxrpjhc.exe
2025-06-22 02:00:33,812 [analyzer] INFO: Added new file to list with pid 2912 and path C:\Temp\wuomgezwrp.exe
2025-06-22 02:03:40,203 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-06-22 02:03:41,828 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-06-22 02:03:41,828 [lib.api.process] INFO: Successfully terminated process with pid 2912.
2025-06-22 02:03:41,828 [lib.api.process] INFO: Successfully terminated process with pid 1568.
2025-06-22 02:03:41,828 [analyzer] WARNING: File at path u'\\device\\namedpipe\\lsass' does not exist, skip.
2025-06-22 02:03:41,858 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-06-27 11:55:31,919 [cuckoo.core.scheduler] INFO: Task #6600792: acquired machine win7x6420 (label=win7x6420)
2025-06-27 11:55:31,920 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.220 for task #6600792
2025-06-27 11:55:32,436 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 232107 (interface=vboxnet0, host=192.168.168.220)
2025-06-27 11:55:32,910 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6420
2025-06-27 11:55:33,748 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6420 to vmcloak
2025-06-27 11:59:17,848 [cuckoo.core.guest] INFO: Starting analysis #6600792 on guest (id=win7x6420, ip=192.168.168.220)
2025-06-27 11:59:18,854 [cuckoo.core.guest] DEBUG: win7x6420: not ready yet
2025-06-27 11:59:23,881 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6420, ip=192.168.168.220)
2025-06-27 11:59:23,977 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6420, ip=192.168.168.220, monitor=latest, size=6660546)
2025-06-27 11:59:25,385 [cuckoo.core.resultserver] DEBUG: Task #6600792: live log analysis.log initialized.
2025-06-27 11:59:26,264 [cuckoo.core.resultserver] DEBUG: Task #6600792 is sending a BSON stream
2025-06-27 11:59:27,332 [cuckoo.core.resultserver] DEBUG: Task #6600792 is sending a BSON stream
2025-06-27 11:59:27,532 [cuckoo.core.resultserver] DEBUG: Task #6600792: File upload for 'shots/0001.jpg'
2025-06-27 11:59:27,585 [cuckoo.core.resultserver] DEBUG: Task #6600792 uploaded file length: 133462
2025-06-27 11:59:28,394 [cuckoo.core.resultserver] DEBUG: Task #6600792 is sending a BSON stream
2025-06-27 11:59:28,583 [cuckoo.core.resultserver] DEBUG: Task #6600792 is sending a BSON stream
2025-06-27 11:59:31,500 [cuckoo.core.resultserver] DEBUG: Task #6600792 is sending a BSON stream
2025-06-27 11:59:31,777 [cuckoo.core.resultserver] DEBUG: Task #6600792: File upload for 'files/b15224e967ea7d61_mhfzxrpjhc.exe'
2025-06-27 11:59:31,782 [cuckoo.core.resultserver] DEBUG: Task #6600792 uploaded file length: 369664
2025-06-27 11:59:36,925 [cuckoo.core.resultserver] DEBUG: Task #6600792: File upload for 'files/6be81914ca749ba4_i_mhfzxrpjhc.exe'
2025-06-27 11:59:36,930 [cuckoo.core.resultserver] DEBUG: Task #6600792 uploaded file length: 369664
2025-06-27 11:59:39,969 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6600792 still processing
2025-06-27 11:59:55,473 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6600792 still processing
2025-06-27 12:00:10,550 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6600792 still processing
2025-06-27 12:00:26,203 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6600792 still processing
2025-06-27 12:00:41,541 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6600792 still processing
2025-06-27 12:00:56,915 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6600792 still processing
2025-06-27 12:01:12,775 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6600792 still processing
2025-06-27 12:01:27,901 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6600792 still processing
2025-06-27 12:01:44,032 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6600792 still processing
2025-06-27 12:02:00,600 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6600792 still processing
2025-06-27 12:02:16,121 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6600792 still processing
2025-06-27 12:02:31,740 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6600792 still processing
2025-06-27 12:02:45,782 [cuckoo.core.resultserver] DEBUG: Task #6600792: File upload for 'curtain/1750550620.45.curtain.log'
2025-06-27 12:02:45,785 [cuckoo.core.resultserver] DEBUG: Task #6600792 uploaded file length: 36
2025-06-27 12:02:46,872 [cuckoo.core.guest] DEBUG: win7x6420: analysis #6600792 still processing
2025-06-27 12:02:46,978 [cuckoo.core.resultserver] DEBUG: Task #6600792: File upload for 'sysmon/1750550621.64.sysmon.xml'
2025-06-27 12:02:47,152 [cuckoo.core.resultserver] DEBUG: Task #6600792 uploaded file length: 14873236
2025-06-27 12:02:47,178 [cuckoo.core.resultserver] DEBUG: Task #6600792: File upload for 'files/0beea2e74bc655f0_ljdbvtnlgdywqoig.exe'
2025-06-27 12:02:47,180 [cuckoo.core.resultserver] DEBUG: Task #6600792: File upload for 'files/199f46e6d60858bd_wuomgezwrp.exe'
2025-06-27 12:02:47,184 [cuckoo.core.resultserver] DEBUG: Task #6600792: File upload for 'files/368bcf5c4b27fc00_createprocess.exe'
2025-06-27 12:02:47,186 [cuckoo.core.resultserver] DEBUG: Task #6600792 uploaded file length: 3584
2025-06-27 12:02:47,187 [cuckoo.core.resultserver] DEBUG: Task #6600792 uploaded file length: 369664
2025-06-27 12:02:47,190 [cuckoo.core.resultserver] DEBUG: Task #6600792 uploaded file length: 369664
2025-06-27 12:02:47,193 [cuckoo.core.resultserver] DEBUG: Task #6600792: File upload for 'files/8d409b613e54939d_ljdbvtnlgdywqoig.sys'
2025-06-27 12:02:47,200 [cuckoo.core.resultserver] DEBUG: Task #6600792 uploaded file length: 300544
2025-06-27 12:02:47,211 [cuckoo.core.resultserver] DEBUG: Task #6600792 had connection reset for <Context for LOG>
2025-06-27 12:02:49,895 [cuckoo.core.guest] INFO: win7x6420: analysis completed successfully
2025-06-27 12:02:49,910 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-06-27 12:02:49,943 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-06-27 12:02:51,212 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6420 to path /srv/cuckoo/cwd/storage/analyses/6600792/memory.dmp
2025-06-27 12:02:51,213 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6420
2025-06-27 12:05:12,022 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.220 for task #6600792
2025-06-27 12:05:14,061 [cuckoo.core.scheduler] DEBUG: Released database task #6600792
2025-06-27 12:05:24,238 [cuckoo.core.scheduler] INFO: Task #6600792: analysis procedure completed

Signatures

Yara rules detected for file (10 events)

description	Possibly employs anti-virtualization techniques	rule	vmdetect
description	Checks if being debugged	rule	anti_dbg
description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Create a windows service	rule	create_service
description	Communications over HTTP	rule	network_http
description	File downloader/dropper	rule	network_dropper
description	Communications over RAW socket	rule	network_tcp_socket
description	Escalade priviledges	rule	escalate_priv
description	Take screenshot	rule	screenshot
description	Run a keylogger	rule	keylogger

Allocates read-write-execute memory (usually to unpack itself) (8 events)

Time & API	Arguments	Status
NtProtectVirtualMemory June 22, 2025, 2:53 a.m.	process_identifier: 1568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff04f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 22, 2025, 2:53 a.m.	process_identifier: 1568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff026000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 22, 2025, 2:53 a.m.	process_identifier: 1568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff026000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 22, 2025, 2:53 a.m.	process_identifier: 1568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff026000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 22, 2025, 2:53 a.m.	process_identifier: 1568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefb09b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 22, 2025, 2:53 a.m.	process_identifier: 1568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef4074000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory June 22, 2025, 2:53 a.m.	process_identifier: 1568 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3934000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory June 22, 2025, 2:53 a.m.	process_identifier: 1568 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002980000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

This executable has a PDB path (1 event)

pdb_path

f:\è½¯ä»¶å·¥ç¨\é©±å¨ç¼ç¨\OK\KernelYK\bin\InstallSYS.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 22, 2025, 3 a.m.		1	1	0

Foreign language identified in PE resource (7 events)

name

RT_ICON

language

LANG_CHINESE

filetype

Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005bec0

size

0x0000052c

name

RT_ICON

language

LANG_CHINESE

filetype

Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005bec0

size

0x0000052c

name

RT_ICON

language

LANG_CHINESE

filetype

Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005bec0

size

0x0000052c

name

RT_ICON

language

LANG_CHINESE

filetype

Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005bec0

size

0x0000052c

name

RT_DIALOG

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005c3ec

size

0x00000094

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005c480

size

0x0000003e

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005c4c0

size

0x000002cc

Creates executable files on the filesystem (5 events)

file	C:\Temp\wuomgezwrp.exe
file	C:\Temp\i_mhfzxrpjhc.exe
file	C:\Temp\mhfzxrpjhc.exe
file	C:\Temp\ljdbvtnlgdywqoig.exe
file	C:\Temp\CreateProcess.exe

Creates a service (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW June 22, 2025, 3 a.m.	service_start_name: start_type: 3 password: display_name: ljdbvtnlgdywqoig filepath: C:\Temp\ljdbvtnlgdywqoig.sys service_name: ljdbvtnlgdywqoig filepath_r: C:\Temp\ljdbvtnlgdywqoig.sys desired_access: 983551 service_handle: 0x00828398 error_control: 0 service_type: 1 service_manager_handle: 0x00828438	1	8553368	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 events)

Time & API	Arguments	Status	Return
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: mobsync.exe process_identifier: 1280	1	1
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: taskhost.exe process_identifier: 2040	1	1
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: ljdbvtnlgdywqoig.exe process_identifier: 2912	1	1

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (35 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: 8A6309173BDF0748_AQKICAUSNK.EXE process_identifier: 2548		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: 8A6309173BDF0748_AQKICAUSNK.EXE process_identifier: 2548		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: 8A6309173BDF0748_AQKICAUSNK.EXE process_identifier: 2548		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: 8A6309173BDF0748_AQKICAUSNK.EXE process_identifier: 2548		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: 8A6309173BDF0748_AQKICAUSNK.EXE process_identifier: 2548		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: 8A6309173BDF0748_AQKICAUSNK.EXE process_identifier: 2548		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: 8A6309173BDF0748_AQKICAUSNK.EXE process_identifier: 2548		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: LJDBVTNLGDYWQOIG.EXE process_identifier: 2912		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: IEXPLORE.EXE process_identifier: 1568		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: IEXPLORE.EXE process_identifier: 1568		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: IEXPLORE.EXE process_identifier: 1568		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: IEXPLORE.EXE process_identifier: 1568		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: IEXPLORE.EXE process_identifier: 1568		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: IEXPLORE.EXE process_identifier: 1568		0	0
Process32NextW June 22, 2025, 3 a.m.	snapshot_handle: 0x00000064 process_name: IEXPLORE.EXE process_identifier: 1568		0	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

C:\Program Files\Internet Explorer\iexplore.exe http://xytets.com:2345/t.asp?os=home

Deletes executed files from disk (1 event)

file	C:\Temp\i_mhfzxrpjhc.exe

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Trojan.Generic.7761207 (Engine A), Win32.Trojan.PSE1.YSVY3N (Engine B)
Avast Core Security (Linux)	MBR:Backboot-D [Rtk]
C4S ClamAV (Linux)	Win.Malware.Mikey-9949492-0
Trellix (Linux)	Generic Dropper.aoe trojan
WithSecure (Linux)	Trojan.TR/Rogue.7909438
eScan Antivirus (Linux)	Trojan.Generic.7761207(DB)
ESET Security (Windows)	Win32/Agent.PGA trojan
Sophos Anti-Virus (Linux)	Troj/Drop-GZ
DrWeb Antivirus (Linux)	Trojan.Click2.32800
ClamAV (Linux)	Win.Malware.Mikey-9949492-0
Bitdefender Antivirus (Linux)	Trojan.Generic.7761207
Kaspersky Standard (Windows)	Trojan.Win32.Tiny.cm
Emsisoft Commandline Scanner (Windows)	Trojan.Generic.7761207 (B)

File has been identified by 67 AntiVirus engines on VirusTotal as malicious (50 out of 67 events)

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Daws.lIK3
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
FireEye	Generic.mg.6e4b57814b15abcd
CAT-QuickHeal	Trojan.Mauvaise.SL1
McAfee	Generic Dropper.aoe
ALYac	Trojan.Generic.7761207
Cylance	Unsafe
VIPRE	Trojan.Generic.7761207
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005565241 )
BitDefender	Trojan.Generic.7761207
K7GW	Trojan ( 005565241 )
Cybereason	malicious.14b15a
Arcabit	Trojan.Generic.D766D37
Baidu	Win32.Rootkit.Agent.w
VirIT	Trojan.Win32.Generic.BPPW
Cyren	W32/Pleh.A.gen!Eldorado
Symantec	Trojan.Dropper
ESET-NOD32	Win32/Agent.PGA
APEX	Malicious
Avast	Win32:Agent-AUSD [Rtk]
ClamAV	Win.Malware.Mikey-9949492-0
Kaspersky	Trojan.Win32.Tiny.cm
Alibaba	TrojanDropper:Win32/Systex.79d75a64
NANO-Antivirus	Trojan.Win32.Invader.vxfyv
SUPERAntiSpyware	Trojan.Agent/Gen-Systex
MicroWorld-eScan	Trojan.Generic.7761207
Rising	Trojan.Agent!1.C16F (CLASSIC)
Ad-Aware	Trojan.Generic.7761207
Emsisoft	Trojan.Generic.7761207 (B)
Comodo	TrojWare.Win32.Clicker.naf@4qkqfk
F-Secure	Trojan.TR/Rogue.7909438
DrWeb	Trojan.Click2.32800
Zillya	Dropper.Daws.Win32.2427
TrendMicro	TSPY_ROGUE_BK084025.TOMC
McAfee-GW-Edition	BehavesLike.Win32.Dropper.fh
Trapmine	suspicious.low.ml.score
Sophos	ML/PE-A + Troj/Drop-GZ
Ikarus	Trojan.SuspectCRC
Jiangmin	Trojan/Invader.gje
Webroot	W32.Invader
Avira	TR/Rogue.7909438
MAX	malware (ai score=89)
Antiy-AVL	Trojan[Dropper]/Win32.Daws.aumx
Kingsoft	Win32.Heur.KVM005.a.(kcloud)
Gridinsoft	Trojan.Win32.Agent.vb!s1
Microsoft	TrojanDropper:Win32/Systex.A
ViRobot	Dropper.Daws.Gen.A

Screenshots

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action	VT	Location
No hosts contacted.

Browser recommendation

File 8a6309173bdf0748_aqkicausnk.exe

Summary Download Resubmit sample

Score

Autosubmit

Feedback

Information on Execution

Analyzer Log

Cuckoo Log

Signatures

Feedback

Summary
Download Resubmit sample