Cuckoo Sandbox

File 1507702e4fbeaecd_mjebwuomge.exe

Summary
Download Resubmit sample

Size	361.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`910de2f3e8773c6a4c05bc941ffd62dd`
SHA1	`5cb1a5a950c4a4e9c319aab5dcfef07f5f3c0d4c`
SHA256	`1507702e4fbeaecdbf524fb69359b3a3868b986312b4b19c3598abbfead77397`
SHA512	`293f331861ee6c8f55038bbd6b5a68e01f97c4c64437d4506a7b3b8897a77445cbda0448a48a5be5c38cc15af3afb761f8d58a738f166df46c7c47bc0b13c2c3`
CRC32	`1EEB1561`
ssdeep	`None`
PDB Path	f:\è½¯ä»¶å·¥ç¨\é©±å¨ç¼ç¨\OK\KernelYK\bin\InstallSYS.pdb
Yara	vmdetect - Possibly employs anti-virtualization techniques anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process create_service - Create a windows service network_http - Communications over HTTP network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6702903

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis

Category	Started	Completed	Duration	Routing	Logs
FILE	July 18, 2025, 4:22 a.m.	July 18, 2025, 4:30 a.m.	456 seconds	internet	Show Analyzer Log Show Cuckoo Log

Analyzer Log

2025-07-14 05:02:15,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpwoh6zt
2025-07-14 05:02:15,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\PfkjFiUHPLQwAvPbXF
2025-07-14 05:02:15,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\fxREOYzXiSjSzNsr
2025-07-14 05:02:15,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-07-14 05:02:15,030 [analyzer] INFO: Automatically selected analysis package "exe"
2025-07-14 05:02:15,530 [analyzer] DEBUG: Started auxiliary module Curtain
2025-07-14 05:02:15,530 [analyzer] DEBUG: Started auxiliary module DbgView
2025-07-14 05:02:16,062 [analyzer] DEBUG: Started auxiliary module Disguise
2025-07-14 05:02:16,280 [analyzer] DEBUG: Loaded monitor into process with pid 500
2025-07-14 05:02:16,280 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-07-14 05:02:16,296 [analyzer] DEBUG: Started auxiliary module Human
2025-07-14 05:02:16,296 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-07-14 05:02:16,296 [analyzer] DEBUG: Started auxiliary module Reboot
2025-07-14 05:02:16,390 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-07-14 05:02:16,405 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-07-14 05:02:16,405 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-07-14 05:02:16,405 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-07-14 05:02:16,640 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\1507702e4fbeaecd_mjebwuomge.exe' with arguments '' and pid 2392
2025-07-14 05:02:16,812 [analyzer] DEBUG: Loaded monitor into process with pid 2392
2025-07-14 05:02:17,342 [analyzer] INFO: Added new file to list with pid 2392 and path C:\Temp\CreateProcess.exe
2025-07-14 05:02:18,342 [analyzer] INFO: Added new file to list with pid 2392 and path C:\Temp\rljebwuomgeywroj.exe
2025-07-14 05:02:18,483 [analyzer] INFO: Injected into process with pid 1248 and name u'rljebwuomgeywroj.exe'
2025-07-14 05:02:18,687 [analyzer] DEBUG: Loaded monitor into process with pid 1248
2025-07-14 05:02:18,717 [analyzer] INFO: Injected into process with pid 220 and name u'iexplore.exe'
2025-07-14 05:02:18,733 [analyzer] INFO: Added new file to list with pid 1248 and path \Device\NamedPipe\lsass
2025-07-14 05:02:19,046 [analyzer] DEBUG: Loaded monitor into process with pid 220
2025-07-14 05:02:20,733 [analyzer] INFO: Added new file to list with pid 2392 and path C:\Temp\rljebwuomgeywroj.sys
2025-07-14 05:02:21,453 [analyzer] INFO: Added new file to list with pid 1248 and path C:\Temp\fdxvpnhfax.exe
2025-07-14 05:02:21,500 [analyzer] INFO: Injected into process with pid 2452 and name u'CreateProcess.exe'
2025-07-14 05:02:21,671 [analyzer] DEBUG: Loaded monitor into process with pid 2452
2025-07-14 05:02:21,671 [analyzer] INFO: Process with pid 2392 has terminated
2025-07-14 05:02:22,671 [analyzer] INFO: Process with pid 2452 has terminated
2025-07-14 05:02:24,203 [analyzer] INFO: Added new file to list with pid 1248 and path C:\Temp\i_fdxvpnhfax.exe
2025-07-14 05:02:29,703 [analyzer] INFO: Added new file to list with pid 1248 and path C:\Temp\hfzxspkhca.exe
2025-07-14 05:05:35,671 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-07-14 05:05:36,592 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-07-14 05:05:36,592 [lib.api.process] INFO: Successfully terminated process with pid 1248.
2025-07-14 05:05:36,592 [lib.api.process] INFO: Successfully terminated process with pid 220.
2025-07-14 05:05:36,592 [analyzer] WARNING: File at path u'\\device\\namedpipe\\lsass' does not exist, skip.
2025-07-14 05:05:36,625 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-07-18 04:22:45,462 [cuckoo.core.scheduler] INFO: Task #6729844: acquired machine win7x643 (label=win7x643)
2025-07-18 04:22:45,465 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.203 for task #6729844
2025-07-18 04:22:45,822 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 1691315 (interface=vboxnet0, host=192.168.168.203)
2025-07-18 04:22:46,209 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x643
2025-07-18 04:22:47,112 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x643 to vmcloak
2025-07-18 04:24:43,970 [cuckoo.core.guest] INFO: Starting analysis #6729844 on guest (id=win7x643, ip=192.168.168.203)
2025-07-18 04:24:44,978 [cuckoo.core.guest] DEBUG: win7x643: not ready yet
2025-07-18 04:24:50,004 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x643, ip=192.168.168.203)
2025-07-18 04:24:50,126 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x643, ip=192.168.168.203, monitor=latest, size=6660546)
2025-07-18 04:24:51,784 [cuckoo.core.resultserver] DEBUG: Task #6729844: live log analysis.log initialized.
2025-07-18 04:24:53,012 [cuckoo.core.resultserver] DEBUG: Task #6729844 is sending a BSON stream
2025-07-18 04:24:53,529 [cuckoo.core.resultserver] DEBUG: Task #6729844 is sending a BSON stream
2025-07-18 04:24:54,344 [cuckoo.core.resultserver] DEBUG: Task #6729844: File upload for 'shots/0001.jpg'
2025-07-18 04:24:54,365 [cuckoo.core.resultserver] DEBUG: Task #6729844 uploaded file length: 133458
2025-07-18 04:24:55,384 [cuckoo.core.resultserver] DEBUG: Task #6729844 is sending a BSON stream
2025-07-18 04:24:55,957 [cuckoo.core.resultserver] DEBUG: Task #6729844 is sending a BSON stream
2025-07-18 04:24:58,433 [cuckoo.core.resultserver] DEBUG: Task #6729844 is sending a BSON stream
2025-07-18 04:24:59,008 [cuckoo.core.resultserver] DEBUG: Task #6729844: File upload for 'files/929f306071bc8cdd_fdxvpnhfax.exe'
2025-07-18 04:24:59,035 [cuckoo.core.resultserver] DEBUG: Task #6729844 uploaded file length: 369664
2025-07-18 04:25:03,838 [cuckoo.core.resultserver] DEBUG: Task #6729844: File upload for 'files/3bf658af03fe3ce0_i_fdxvpnhfax.exe'
2025-07-18 04:25:03,845 [cuckoo.core.resultserver] DEBUG: Task #6729844 uploaded file length: 369664
2025-07-18 04:25:06,337 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729844 still processing
2025-07-18 04:25:21,426 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729844 still processing
2025-07-18 04:25:36,545 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729844 still processing
2025-07-18 04:25:51,733 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729844 still processing
2025-07-18 04:26:06,839 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729844 still processing
2025-07-18 04:26:21,984 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729844 still processing
2025-07-18 04:26:37,072 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729844 still processing
2025-07-18 04:26:52,262 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729844 still processing
2025-07-18 04:27:07,348 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729844 still processing
2025-07-18 04:27:22,430 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729844 still processing
2025-07-18 04:27:37,581 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729844 still processing
2025-07-18 04:27:52,729 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729844 still processing
2025-07-18 04:28:07,940 [cuckoo.core.guest] DEBUG: win7x643: analysis #6729844 still processing
2025-07-18 04:28:12,731 [cuckoo.core.resultserver] DEBUG: Task #6729844: File upload for 'curtain/1752462335.89.curtain.log'
2025-07-18 04:28:12,735 [cuckoo.core.resultserver] DEBUG: Task #6729844 uploaded file length: 36
2025-07-18 04:28:13,359 [cuckoo.core.resultserver] DEBUG: Task #6729844: File upload for 'sysmon/1752462336.53.sysmon.xml'
2025-07-18 04:28:13,417 [cuckoo.core.resultserver] DEBUG: Task #6729844 uploaded file length: 8204576
2025-07-18 04:28:13,432 [cuckoo.core.resultserver] DEBUG: Task #6729844: File upload for 'files/dd738bbf0b18a204_hfzxspkhca.exe'
2025-07-18 04:28:13,435 [cuckoo.core.resultserver] DEBUG: Task #6729844: File upload for 'files/0b4d59f4e65235f2_rljebwuomgeywroj.exe'
2025-07-18 04:28:13,439 [cuckoo.core.resultserver] DEBUG: Task #6729844 uploaded file length: 369664
2025-07-18 04:28:13,441 [cuckoo.core.resultserver] DEBUG: Task #6729844 uploaded file length: 369664
2025-07-18 04:28:13,443 [cuckoo.core.resultserver] DEBUG: Task #6729844: File upload for 'files/13f1b34c95913781_createprocess.exe'
2025-07-18 04:28:13,445 [cuckoo.core.resultserver] DEBUG: Task #6729844 uploaded file length: 3584
2025-07-18 04:28:13,447 [cuckoo.core.resultserver] DEBUG: Task #6729844: File upload for 'files/85c51c6e92357388_rljebwuomgeywroj.sys'
2025-07-18 04:28:13,453 [cuckoo.core.resultserver] DEBUG: Task #6729844 uploaded file length: 300544
2025-07-18 04:28:13,568 [cuckoo.core.resultserver] DEBUG: Task #6729844 had connection reset for <Context for LOG>
2025-07-18 04:28:13,994 [cuckoo.core.guest] INFO: win7x643: analysis completed successfully
2025-07-18 04:28:14,006 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-07-18 04:28:14,035 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-07-18 04:28:14,953 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x643 to path /srv/cuckoo/cwd/storage/analyses/6729844/memory.dmp
2025-07-18 04:28:14,959 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x643
2025-07-18 04:30:21,467 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.203 for task #6729844
2025-07-18 04:30:21,857 [cuckoo.core.scheduler] DEBUG: Released database task #6729844
2025-07-18 04:30:21,873 [cuckoo.core.scheduler] INFO: Task #6729844: analysis procedure completed

Signatures

Yara rules detected for file (10 events)

description	Possibly employs anti-virtualization techniques	rule	vmdetect
description	Checks if being debugged	rule	anti_dbg
description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Create a windows service	rule	create_service
description	Communications over HTTP	rule	network_http
description	File downloader/dropper	rule	network_dropper
description	Communications over RAW socket	rule	network_tcp_socket
description	Escalade priviledges	rule	escalate_priv
description	Take screenshot	rule	screenshot
description	Run a keylogger	rule	keylogger

Allocates read-write-execute memory (usually to unpack itself) (8 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 14, 2025, 5:55 a.m.	process_identifier: 220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff0af000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2025, 5:55 a.m.	process_identifier: 220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff086000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2025, 5:55 a.m.	process_identifier: 220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff086000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2025, 5:55 a.m.	process_identifier: 220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007feff086000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2025, 5:55 a.m.	process_identifier: 220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefaa9b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2025, 5:55 a.m.	process_identifier: 220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef32d4000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 14, 2025, 5:55 a.m.	process_identifier: 220 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3384000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 14, 2025, 5:55 a.m.	process_identifier: 220 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003120000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

This executable has a PDB path (1 event)

pdb_path

f:\è½¯ä»¶å·¥ç¨\é©±å¨ç¼ç¨\OK\KernelYK\bin\InstallSYS.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 14, 2025, 6:02 a.m.		1	1	0

Foreign language identified in PE resource (7 events)

name

RT_ICON

language

LANG_CHINESE

filetype

Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005bec0

size

0x0000052c

name

RT_ICON

language

LANG_CHINESE

filetype

Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005bec0

size

0x0000052c

name

RT_ICON

language

LANG_CHINESE

filetype

Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005bec0

size

0x0000052c

name

RT_ICON

language

LANG_CHINESE

filetype

Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005bec0

size

0x0000052c

name

RT_DIALOG

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005c3ec

size

0x00000094

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005c480

size

0x0000003e

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005c4c0

size

0x000002cc

Creates executable files on the filesystem (5 events)

file	C:\Temp\hfzxspkhca.exe
file	C:\Temp\rljebwuomgeywroj.exe
file	C:\Temp\fdxvpnhfax.exe
file	C:\Temp\i_fdxvpnhfax.exe
file	C:\Temp\CreateProcess.exe

Creates a service (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW July 14, 2025, 6:02 a.m.	service_start_name: start_type: 3 password: display_name: rljebwuomgeywroj filepath: C:\Temp\rljebwuomgeywroj.sys service_name: rljebwuomgeywroj filepath_r: C:\Temp\rljebwuomgeywroj.sys desired_access: 983551 service_handle: 0x004483a8 error_control: 0 service_type: 1 service_manager_handle: 0x00448448	1	4490152	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: taskhost.exe process_identifier: 308	1	1	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: 1507702e4fbeaecd_mjebwuomge.exe process_identifier: 2392	1	1	0

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (35 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: 1507702E4FBEAECD_MJEBWUOMGE.EXE process_identifier: 2392		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: 1507702E4FBEAECD_MJEBWUOMGE.EXE process_identifier: 2392		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: 1507702E4FBEAECD_MJEBWUOMGE.EXE process_identifier: 2392		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: 1507702E4FBEAECD_MJEBWUOMGE.EXE process_identifier: 2392		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: 1507702E4FBEAECD_MJEBWUOMGE.EXE process_identifier: 2392		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: 1507702E4FBEAECD_MJEBWUOMGE.EXE process_identifier: 2392		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: 1507702E4FBEAECD_MJEBWUOMGE.EXE process_identifier: 2392		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: RLJEBWUOMGEYWROJ.EXE process_identifier: 1248		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: INJECT-X64.EXE process_identifier: 2524		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: INJECT-X64.EXE process_identifier: 2524		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: INJECT-X64.EXE process_identifier: 2524		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: INJECT-X64.EXE process_identifier: 2524		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: INJECT-X64.EXE process_identifier: 2524		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: INJECT-X64.EXE process_identifier: 2524		0	0
Process32NextW July 14, 2025, 6:02 a.m.	snapshot_handle: 0x00000064 process_name: INJECT-X64.EXE process_identifier: 2524		0	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

C:\Program Files\Internet Explorer\iexplore.exe http://xytets.com:2345/t.asp?os=home

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Trojan.Generic.7761207 (Engine A), Win32.Trojan.PSE1.YSVY3N (Engine B)
Avast Core Security (Linux)	MBR:Backboot-D [Rtk]
C4S ClamAV (Linux)	Win.Malware.Mikey-9949492-0
Trellix (Linux)	Generic Dropper.aoe trojan
WithSecure (Linux)	Trojan.TR/Rogue.7909438
eScan Antivirus (Linux)	Trojan.Generic.7761207(DB)
ESET Security (Windows)	Win32/Agent.PGA trojan
Sophos Anti-Virus (Linux)	Troj/Drop-GZ
DrWeb Antivirus (Linux)	Trojan.Click2.32800
ClamAV (Linux)	Win.Malware.Mikey-9949492-0
Bitdefender Antivirus (Linux)	Trojan.Generic.7761207
Kaspersky Standard (Windows)	Trojan.Win32.Tiny.cm
Emsisoft Commandline Scanner (Windows)	Trojan.Generic.7761207 (B)

File has been identified by 65 AntiVirus engines on VirusTotal as malicious (50 out of 65 events)

Bkav	W32.AlustinD.Trojan
ClamAV	Win.Trojan.Agent-410649
CAT-QuickHeal	Trojan.Mauvaise.SL1
Qihoo-360	Trojan.Win32.NtHook.A
McAfee	Generic Dropper.aoe
ALYac	Trojan.Generic.7761207
Cylance	Unsafe
VIPRE	Trojan.Win32.Invader.b (v)
Sangfor	Malware
K7AntiVirus	Trojan ( 005565241 )
BitDefender	Trojan.Generic.7761207
K7GW	Trojan ( 005565241 )
Cybereason	malicious.3e8773
Arcabit	Trojan.Generic.D766D37
Invincea	heuristic
Baidu	Win32.Rootkit.Agent.w
Cyren	W32/Pleh.A.gen!Eldorado
Symantec	Trojan.Dropper
ESET-NOD32	Win32/Agent.PGA
APEX	Malicious
Avast	Win32:Agent-AUSD [Rtk]
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.Tiny.cm
Alibaba	TrojanDropper:Win32/Systex.c092fd7f
NANO-Antivirus	Trojan.Win32.Invader.vxfyv
SUPERAntiSpyware	Trojan.Agent/Gen-Systex
MicroWorld-eScan	Trojan.Generic.7761207
Rising	Backdoor.Farfli!1.64D7 (CLOUD)
Ad-Aware	Trojan.Generic.7761207
Emsisoft	Trojan.Generic.7761207 (B)
Comodo	TrojWare.Win32.Clicker.naf@4qkqfk
F-Secure	Trojan.TR/Rogue.7909438
DrWeb	Trojan.Click2.32800
Zillya	Dropper.Daws.Win32.2427
TrendMicro	TSPY_ROGUE_BK084025.TOMC
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.910de2f3e8773c6a
Sophos	Troj/Drop-GZ
Ikarus	Trojan.SuspectCRC
F-Prot	W32/Pleh.A.gen!Eldorado
Jiangmin	Trojan/Invader.gje
Webroot	W32.Invader
Avira	TR/Rogue.7909438
MAX	malware (ai score=82)
Antiy-AVL	Trojan[Dropper]/Win32.Daws.aumx
Microsoft	TrojanDropper:Win32/Systex.A
Endgame	malicious (high confidence)
ViRobot	Dropper.Daws.Gen.A
AhnLab-V3	Dropper/Win32.Daws.R34837
ZoneAlarm	Trojan.Win32.Tiny.cm

Screenshots

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action	VT	Location
No hosts contacted.

Browser recommendation

File 1507702e4fbeaecd_mjebwuomge.exe

Summary Download Resubmit sample

Score

Autosubmit

Feedback

Information on Execution

Analyzer Log

Cuckoo Log

Signatures

Feedback

Summary
Download Resubmit sample