sss81242.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | March 17, 2025, 9:39 a.m. | March 17, 2025, 10:02 a.m. |
-
-
-
gThseXGYz6VkS34E.exe C:\Users\test22\AppData\Local\Temp\dRA90OLc\gThseXGYz6VkS34E.exe 0
2284
-
-
NXonNmvE9cRRFfxL.exe C:\Users\test22\AppData\Local\Temp\NXonNmvE9cRRFfxL.exe 2552
2684 -
cHR8R5ijyj1Ic1Y9.exe C:\Users\test22\AppData\Local\Temp\cHR8R5ijyj1Ic1Y9.exe 2552
2724 -
aib0Q1C72l45FOvW.exe C:\Users\test22\AppData\Local\Temp\aib0Q1C72l45FOvW.exe 2552
2764 -
gV47SdjcEzTDlUBt.exe C:\Users\test22\AppData\Local\Temp\gV47SdjcEzTDlUBt.exe 2552
2808 -
0STUp9LWMUPLvYAo.exe C:\Users\test22\AppData\Local\Temp\0STUp9LWMUPLvYAo.exe 2552
2852 -
YkHscCZsekqgi3Ns.exe C:\Users\test22\AppData\Local\Temp\YkHscCZsekqgi3Ns.exe 2552
2920 -
f7clVsTKgBeGBZm1.exe C:\Users\test22\AppData\Local\Temp\f7clVsTKgBeGBZm1.exe 2552
2548 -
z1yeYXhNXfWOcn4u.exe C:\Users\test22\AppData\Local\Temp\z1yeYXhNXfWOcn4u.exe 2552
4560 -
NJzn2Uzi0Eo8JgrZ.exe C:\Users\test22\AppData\Local\Temp\NJzn2Uzi0Eo8JgrZ.exe 2552
4248 -
Im8VwB4YUvmJZae6.exe C:\Users\test22\AppData\Local\Temp\Im8VwB4YUvmJZae6.exe 2552
3388 -
xqIyPU1Pncvy4Wif.exe C:\Users\test22\AppData\Local\Temp\xqIyPU1Pncvy4Wif.exe 2552
4676 -
Di940XWRk4TvkcIn.exe C:\Users\test22\AppData\Local\Temp\Di940XWRk4TvkcIn.exe 2552
5408 -
yXZJ2Z1iWleuXExA.exe C:\Users\test22\AppData\Local\Temp\yXZJ2Z1iWleuXExA.exe 2552
14820 -
qVHqqCmUJT4LLZxK.exe C:\Users\test22\AppData\Local\Temp\qVHqqCmUJT4LLZxK.exe 2552
12456 -
PyH3oS4HVckLB6EE.exe C:\Users\test22\AppData\Local\Temp\PyH3oS4HVckLB6EE.exe 2552
3152 -
ldlnYW79I6TMCEw3.exe C:\Users\test22\AppData\Local\Temp\ldlnYW79I6TMCEw3.exe 2552
14288 -
0hZyrWhxomMrOptC.exe C:\Users\test22\AppData\Local\Temp\0hZyrWhxomMrOptC.exe 2552
14052 -
seJrfTgW2l6OVW78.exe C:\Users\test22\AppData\Local\Temp\seJrfTgW2l6OVW78.exe 2552
5032
-
-
explorer.exe C:\Windows\Explorer.EXE
1452
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 77.90.153.245:8293 -> 192.168.56.101:49238 | 2400006 | ET DROP Spamhaus DROP Listed Traffic Inbound group 7 | Misc Attack |
| TCP 77.90.153.244:80 -> 192.168.56.101:49236 | 2400006 | ET DROP Spamhaus DROP Listed Traffic Inbound group 7 | Misc Attack |
| TCP 192.168.56.101:49236 -> 77.90.153.244:80 | 2016141 | ET INFO Executable Download from dotted-quad Host | Potentially Bad Traffic |
| TCP 77.90.153.244:80 -> 192.168.56.101:49236 | 2018959 | ET POLICY PE EXE or DLL Windows file download HTTP | Potential Corporate Privacy Violation |
| TCP 77.90.153.244:80 -> 192.168.56.101:49236 | 2021076 | ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response | Potentially Bad Traffic |
Suricata TLS
No Suricata TLS
| suspicious_features | Connection to IP address | suspicious_request | GET http://77.90.153.244/l9543.exe | ||||||
| request | GET http://77.90.153.244/l9543.exe |
| description | aib0Q1C72l45FOvW.exe tried to sleep 1005 seconds, actually delayed analysis time by 1005 seconds | |||
| description | NXonNmvE9cRRFfxL.exe tried to sleep 1135 seconds, actually delayed analysis time by 1135 seconds | |||
| description | cHR8R5ijyj1Ic1Y9.exe tried to sleep 964 seconds, actually delayed analysis time by 964 seconds | |||
| description | yXZJ2Z1iWleuXExA.exe tried to sleep 317 seconds, actually delayed analysis time by 317 seconds | |||
| description | f7clVsTKgBeGBZm1.exe tried to sleep 855 seconds, actually delayed analysis time by 855 seconds | |||
| description | Di940XWRk4TvkcIn.exe tried to sleep 390 seconds, actually delayed analysis time by 390 seconds | |||
| description | z1yeYXhNXfWOcn4u.exe tried to sleep 787 seconds, actually delayed analysis time by 787 seconds | |||
| description | NJzn2Uzi0Eo8JgrZ.exe tried to sleep 526 seconds, actually delayed analysis time by 526 seconds | |||
| description | gV47SdjcEzTDlUBt.exe tried to sleep 788 seconds, actually delayed analysis time by 788 seconds | |||
| description | qVHqqCmUJT4LLZxK.exe tried to sleep 232 seconds, actually delayed analysis time by 232 seconds | |||
| description | 0STUp9LWMUPLvYAo.exe tried to sleep 1185 seconds, actually delayed analysis time by 1185 seconds | |||
| description | vpZvQeDoVnhQnT6u.exe tried to sleep 155 seconds, actually delayed analysis time by 155 seconds | |||
| description | xqIyPU1Pncvy4Wif.exe tried to sleep 396 seconds, actually delayed analysis time by 396 seconds | |||
| description | Im8VwB4YUvmJZae6.exe tried to sleep 549 seconds, actually delayed analysis time by 549 seconds | |||
| description | YkHscCZsekqgi3Ns.exe tried to sleep 652 seconds, actually delayed analysis time by 652 seconds | |||
| file | C:\Users\test22\AppData\Local\Temp\dRA90OLc\gThseXGYz6VkS34E.exe |
| file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk |
| file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk |
| file | C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe |
| file | C:\Users\test22\AppData\Local\Temp\sss81242.exe |
| file | C:\Users\test22\AppData\Local\Temp\202005191702_6d173b9549ce4fe1e5ada5ab9ce0bfff5d9569f19e7fa916db5c8d4f0dace63b_setup_nwc275a_demo.exe |
| process | aib0q1c72l45fovw.exe |
| process | nxonnmve9crrffxl.exe |
| process | sss81242.exe |
| process | pmimfrnhbhgq9xqy.exe |
| process | di940xwrk4tvkcin.exe |
| process | z1yeyxhnxfwocn4u.exe |
| process | njzn2uzi0eo8jgrz.exe |
| process | gv47sdjceztdlubt.exe |
| process | im8vwb4yuvmjzae6.exe |
| process | gi8geoigs8qhmajy.exe |
| process | alpspiz52akc9xpx.exe |
| process | 0stup9lwmuplvyao.exe |
| process | vsoifcvryt3cw1za.exe |
| process | qvhqqcmujt4llzxk.exe |
| process | ldlnyw79i6tmcew3.exe |
| process | oniayhqzco1lxubc.exe |
| process | chr8r5ijyj1ic1y9.exe |
| process | yxzj2z1iwleuxexa.exe |
| process | f7clvstkgbegbzm1.exe |
| process | xqiypu1pncvy4wif.exe |
| process | jbvqkg4nbz7qj9av.exe |
| process | pkf3awcjxtmplg04.exe |
| process | pyh3os4hvcklb6ee.exe |
| process | jbf2ecdgvte5mgyp.exe |
| process | 0hzyrwhxommroptc.exe |
| process | xgt8fijj9xtpzvbr.exe |
| process | ykhscczsekqgi3ns.exe |
| host | 77.90.153.244 | |||
| host | 77.90.153.245 | |||
| file | C:\Users\test22\AppData\Local\Temp\SandboxieInstall.exe |
| reg_key | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\GoogleChrome | reg_value | C:\Users\test22\AppData\Local\Temp\H7lidFjN\vpZvQeDoVnhQnT6u.exe | ||||||
| file | C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GoogleChrome.lnk | ||||||||
| file | C:\Users\test22\AppData\Local\Temp\NJzn2Uzi0Eo8JgrZ.exe |
| file | C:\Users\test22\AppData\Local\Temp\0STUp9LWMUPLvYAo.exe |
| file | C:\Users\test22\AppData\Local\Temp\FXSAPIDebugLogFile.txt |
| file | C:\Users\test22\AppData\Local\Temp\NJzn2Uzi0Eo8JgrZ.exe |
| file | C:\Users\test22\AppData\Local\Temp\vsoIfCvryt3cW1ZA.exe |
| file | C:\Users\test22\AppData\Local\Temp\tmpfcimyk |
| file | C:\Users\test22\AppData\Local\Temp\Di940XWRk4TvkcIn.exe |
| file | C:\Users\test22\AppData\Local\Temp\cHR8R5ijyj1Ic1Y9.exe |
| file | C:\Users\test22\AppData\Local\Temp\seJrfTgW2l6OVW78.exe |
| file | C:\Users\test22\AppData\Local\Temp\tmpv0u7lo |
| file | C:\Users\test22\AppData\Local\Temp\Im8VwB4YUvmJZae6.exe |
| file | C:\Users\test22\AppData\Local\Temp\xqIyPU1Pncvy4Wif.exe |
| file | C:\Users\test22\AppData\Local\Temp\PyH3oS4HVckLB6EE.exe |
| file | C:\Users\test22\AppData\Local\Temp\tmpnc7lwr |
| file | C:\Users\test22\AppData\Local\Temp\aib0Q1C72l45FOvW.exe |
| file | C:\Users\test22\AppData\Local\Temp\z1yeYXhNXfWOcn4u.exe |
| file | C:\Users\test22\AppData\Local\Temp\tmpq6yfmb |
| file | C:\Users\test22\AppData\Local\Temp\SetupExe(20200504224110B04).log |
| file | C:\Users\test22\AppData\Local\Temp\java_install_reg.log |
| file | C:\Users\test22\AppData\Local\Temp\IME2010imeklmg00000011.log |
| file | C:\Users\test22\AppData\Local\Temp\dd_dotnet4.5_decompression_log.txt |
| file | C:\Users\test22\AppData\Local\Temp\sss81242.exe |
| file | C:\Users\test22\AppData\Local\Temp\dd_dotNetFx45LP_Full_x86_x64ko_decompression_log.txt |
| file | C:\Users\test22\AppData\Local\Temp\IME2010imeklmg00000001.log |
| file | C:\Users\test22\AppData\Local\Temp\jawshtml.html |
| file | C:\Users\test22\AppData\Local\Temp\~DFB8537D6963ECB123.TMP |
| file | C:\Users\test22\AppData\Local\Temp\ASPNETSetup_00000.log |
| file | C:\Users\test22\AppData\Local\Temp\dd_vcredist_amd64_20180201144548_000_vcRuntimeMinimum_x64.log |
| file | C:\Users\test22\AppData\Local\Temp\IME2010imeklmg00000013.log |
| file | C:\Users\test22\AppData\Local\Temp\tmpaddon-1 |
| file | C:\Users\test22\AppData\Local\Temp\dd_SetupUtility.txt |
| file | C:\Users\test22\AppData\Local\Temp\ASPNETSetup_00001.log |
| file | C:\Users\test22\AppData\Local\Temp\SetupExe(20180405152043A34).log |
| file | C:\Users\test22\AppData\Local\Temp\dd_vcredist_amd64_20180201144548.log |
| file | C:\Users\test22\AppData\Local\Temp\UserInfoSetup(2018040515215734C).log |
| file | C:\Users\test22\AppData\Local\Temp\RGI1518.tmp-tmp |
| file | C:\Users\test22\AppData\Local\Temp\DMI9EEF.tmp |
| file | C:\Users\test22\AppData\Local\Temp\IME2010imeklmg00000017.log |
| file | C:\Users\test22\AppData\Local\Temp\chrome_installer.log |
| file | C:\Users\test22\AppData\Local\Temp\UserInfoSetup(20180405152131B24).log |
| file | C:\Users\test22\AppData\Local\Temp\Microsoft .NET Framework 4.5 KOR Language Pack Setup_20200715_141443571.html |
| file | C:\Users\test22\AppData\Local\Temp\IME2010imeklmg00000020.log |
| file | C:\Users\test22\AppData\Local\Temp\RGIC87.tmp-tmp |
| file | C:\Users\test22\AppData\Local\Temp\java_install.log |
| file | C:\Users\test22\AppData\Local\Temp\IME2010imeklmg00000007.log |
| file | C:\Users\test22\AppData\Local\Temp\SetupExe(20180405152131B24).log |
| file | C:\Users\test22\AppData\Local\Temp\bchC68D.tmp |
| file | C:\Users\test22\AppData\Local\Temp\Microsoft .NET Framework 4.5 Setup_20200715_141303844.html |
| file | C:\Users\test22\AppData\Local\Temp\PrinterSetup.log |
| file | C:\Users\test22\AppData\Local\Temp\ASPNETSetup_00002.log |
| file | C:\Users\test22\AppData\Local\Temp\dd_TMPA86C.tmp_decompression_log.txt |
| Lionic | Trojan.Win32.BackdoorX.m!c |
| MicroWorld-eScan | Gen:Variant.Doina.84317 |
| CTX | exe.trojan.generic |
| Skyhigh | BehavesLike.Win32.Downloader.dh |
| ALYac | Gen:Variant.Doina.84317 |
| Cylance | Unsafe |
| Sangfor | Suspicious.Win32.Save.a |
| CrowdStrike | win/malicious_confidence_100% (W) |
| K7GW | Trojan ( 005c36431 ) |
| K7AntiVirus | Trojan ( 005c36431 ) |
| Arcabit | Trojan.Doina.D1495D |
| Symantec | Trojan.Whispergate |
| Elastic | malicious (high confidence) |
| ESET-NOD32 | a variant of Win32/Agent.AHAN |
| APEX | Malicious |
| Paloalto | generic.ml |
| Cynet | Malicious (score: 100) |
| Alibaba | Trojan:Win32/BackdoorX.71a23315 |
| Rising | Backdoor.Convagent!8.123DC (CLOUD) |
| Sophos | Mal/Generic-S |
| F-Secure | Trojan.TR/AD.Nekark.vsdpm |
| DrWeb | Trojan.MulDrop29.26479 |
| VIPRE | Gen:Variant.Doina.84317 |
| McAfeeD | Real Protect-LS!58D3A0D574E3 |
| Emsisoft | Gen:Variant.Doina.84317 (B) |
| SentinelOne | Static AI - Malicious PE |
| FireEye | Generic.mg.58d3a0d574e37dc9 |
| Detected | |
| Avira | TR/AD.Nekark.vsdpm |
| Antiy-AVL | Trojan/Win32.Agent |
| Gridinsoft | Ransom.Win32.Wacatac.sa |
| Microsoft | Trojan:Win32/Wacatac.B!ml |
| GData | Gen:Variant.Doina.84317 |
| Varist | W32/ABTrojan.APOM-5687 |
| AhnLab-V3 | Trojan/Win.Doina.C5740788 |
| DeepInstinct | MALICIOUS |
| Malwarebytes | Malware.AI.4210650245 |
| Ikarus | Trojan.Win32.Agent |
| TrendMicro-HouseCall | Trojan.Win32.VSX.PE04C9V |
| Tencent | Win32.Backdoor.Pmax.Hmnw |
| huorong | Trojan/Agent.cca |
| MaxSecure | Trojan.Malware.300983.susgen |
| Fortinet | Malicious_Behavior.SB |
| Panda | Trj/Chgt.AD |
| alibabacloud | Backdoor:Win/PMax.gyf |