Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- %APPDATA%\microsoft\windows\start menu\programs\startup\virus_client.exe
Modifies file system
Creates the following files
- %TEMP%\_mei42882\vcruntime140.dll
- %TEMP%\_mei42882\_bz2.pyd
- %TEMP%\_mei42882\_cffi_backend.cp311-win_amd64.pyd
- %TEMP%\_mei42882\_decimal.pyd
- %TEMP%\_mei42882\_hashlib.pyd
- %TEMP%\_mei42882\_lzma.pyd
- %TEMP%\_mei42882\_socket.pyd
- %TEMP%\_mei42882\base_library.zip
- %TEMP%\_mei42882\cryptography-46.0.5.dist-info\installer
- %TEMP%\_mei42882\cryptography-46.0.5.dist-info\metadata
- %TEMP%\_mei42882\cryptography-46.0.5.dist-info\record
- %TEMP%\_mei42882\cryptography-46.0.5.dist-info\wheel
- %TEMP%\_mei42882\cryptography-46.0.5.dist-info\licenses\license
- %TEMP%\_mei42882\cryptography-46.0.5.dist-info\licenses\license.apache
- %TEMP%\_mei42882\cryptography-46.0.5.dist-info\licenses\license.bsd
- %TEMP%\_mei42882\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei42882\libcrypto-3.dll
- %TEMP%\_mei42882\python3.dll
- %TEMP%\_mei42882\python311.dll
- %TEMP%\_mei42882\select.pyd
- %TEMP%\_mei42882\unicodedata.pyd
- %TEMP%\h7op190t
- %TEMP%\svchost.exe
- %TEMP%\_mei10082\pil\_avif.cp311-win_amd64.pyd
- %TEMP%\_mei10082\pil\_imaging.cp311-win_amd64.pyd
- %TEMP%\_mei10082\pil\_imagingcms.cp311-win_amd64.pyd
- %TEMP%\_mei10082\pil\_imagingmath.cp311-win_amd64.pyd
- %TEMP%\_mei10082\pil\_imagingtk.cp311-win_amd64.pyd
- %TEMP%\_mei10082\pil\_webp.cp311-win_amd64.pyd
- %TEMP%\_mei10082\vcruntime140.dll
- %TEMP%\_mei10082\_bz2.pyd
- %TEMP%\_mei10082\_ctypes.pyd
- %TEMP%\_mei10082\_decimal.pyd
- %TEMP%\_mei10082\_elementtree.pyd
- %TEMP%\_mei10082\_hashlib.pyd
- %TEMP%\_mei10082\_lzma.pyd
- %TEMP%\_mei10082\_queue.pyd
- %TEMP%\_mei10082\_socket.pyd
- %TEMP%\_mei10082\_ssl.pyd
- %TEMP%\_mei10082\base_library.zip
- %TEMP%\_mei10082\libcrypto-3.dll
- %TEMP%\_mei10082\libffi-8.dll
- %TEMP%\_mei10082\libssl-3.dll
- %TEMP%\_mei10082\pyexpat.pyd
- %TEMP%\_mei10082\python311.dll
- %TEMP%\_mei10082\select.pyd
- %TEMP%\_mei10082\unicodedata.pyd
Deletes following files that it created itself
- %TEMP%\h7op190t
- %TEMP%\_mei42882\base_library.zip
- %TEMP%\_mei42882\cryptography\hazmat\bindings\_rust.pyd
- %TEMP%\_mei42882\cryptography-46.0.5.dist-info\installer
- %TEMP%\_mei42882\cryptography-46.0.5.dist-info\licenses\license
- %TEMP%\_mei42882\cryptography-46.0.5.dist-info\licenses\license.apache
- %TEMP%\_mei42882\cryptography-46.0.5.dist-info\licenses\license.bsd
- %TEMP%\_mei42882\cryptography-46.0.5.dist-info\metadata
- %TEMP%\_mei42882\cryptography-46.0.5.dist-info\record
- %TEMP%\_mei42882\cryptography-46.0.5.dist-info\wheel
- %TEMP%\_mei42882\libcrypto-3.dll
- %TEMP%\_mei42882\python3.dll
- %TEMP%\_mei42882\python311.dll
- %TEMP%\_mei42882\select.pyd
- %TEMP%\_mei42882\unicodedata.pyd
- %TEMP%\_mei42882\vcruntime140.dll
- %TEMP%\_mei42882\_bz2.pyd
- %TEMP%\_mei42882\_cffi_backend.cp311-win_amd64.pyd
- %TEMP%\_mei42882\_decimal.pyd
- %TEMP%\_mei42882\_hashlib.pyd
- %TEMP%\_mei42882\_lzma.pyd
- %TEMP%\_mei42882\_socket.pyd
Network activity
Connects to
- '10.#.1.4':4444
Miscellaneous
Creates and executes the following
- '%TEMP%\svchost.exe'
Restarts the analyzed sample
Executes the following
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "vmtoolsd""
- '<SYSTEM32>\tasklist.exe'
- '<SYSTEM32>\find.exe' /i "vmtoolsd"
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "vboxservice""
- '<SYSTEM32>\find.exe' /i "vboxservice"
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "VBoxTray""
- '<SYSTEM32>\find.exe' /i "VBoxTray"
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "xenservice""
- '<SYSTEM32>\find.exe' /i "xenservice"
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "procmon""
- '<SYSTEM32>\find.exe' /i "procmon"
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "wireshark""
- '<SYSTEM32>\find.exe' /i "wireshark"
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "fakenet""
- '<SYSTEM32>\find.exe' /i "fakenet"
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "tcpview""
- '<SYSTEM32>\find.exe' /i "tcpview"
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "ProcessHacker""
- '<SYSTEM32>\find.exe' /i "ProcessHacker"
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "dumpcap""
- '<SYSTEM32>\find.exe' /i "dumpcap"
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "vboxguest""
- '<SYSTEM32>\find.exe' /i "vboxguest"
- '<SYSTEM32>\cmd.exe' /c "driverquery"
- '<SYSTEM32>\driverquery.exe'
- '<SYSTEM32>\cmd.exe' /c "where wireshark"
- '<SYSTEM32>\where.exe' wireshark
- '<SYSTEM32>\cmd.exe' /c "where tcpdump"
- '<SYSTEM32>\where.exe' tcpdump
- '<SYSTEM32>\cmd.exe' /c "where netmon"
- '<SYSTEM32>\where.exe' netmon
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "vmtoolsd""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "vboxservice""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "VBoxTray""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "xenservice""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "procmon""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "wireshark""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "fakenet""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "tcpview""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "ProcessHacker""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "dumpcap""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "tasklist | find /i "vboxguest""' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "driverquery"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "where wireshark"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "where tcpdump"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c "where netmon"' (with hidden window)
