top title background image
flash

CERENAK-8392.exe

Status: finished
Submission Time: 2025-02-24 13:47:14 +01:00
Malicious
Trojan
Spyware
Evader
CryptOne, MSIL Logger, MassLogger RAT

Comments

Tags

  • exe

Details

  • Analysis ID:
    1622714
  • API (Web) ID:
    1622714
  • Analysis Started:
    2025-02-24 13:47:14 +01:00
  • Analysis Finished:
    2025-02-24 13:58:54 +01:00
  • MD5:
    1c2f516dca7bfb450ab98fc6c6c310c6
  • SHA1:
    caa9dd80c3a7f1b8971ec5ae24a514c942fa3f62
  • SHA256:
    2173bf61f12a5c4be159f8b87d77094e84b2074983108b220083c2a37bfaae3e
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 65/76
malicious
Score: 34/38
malicious

IPs

IP Country Detection
108.177.15.82
United States
193.122.6.168
United States
104.21.64.1
United States
Click to see the 3 hidden entries
66.102.1.82
United States
142.251.5.82
United States
51.81.194.202
United States

Domains

Name IP Detection
reallyfreegeoip.org
104.21.64.1
zxq.net
51.81.194.202
googlecode.l.googleusercontent.com
142.251.5.82
Click to see the 7 hidden entries
checkip.dyndns.com
193.122.6.168
vccmd01.zxq.net
51.81.194.202
vccmd03.googlecode.com
0.0.0.0
vccmd01.t35.com
0.0.0.0
vccmd01.googlecode.com
0.0.0.0
checkip.dyndns.org
0.0.0.0
vccmd02.googlecode.com
0.0.0.0

URLs

Name Detection
http://www.fontbureau.com/designers/frere-user.html
https://zxq.net/what-happened-to-the-old-zxq-website/ds
https://zxq.net/write-for-us/
Click to see the 97 hidden entries
http://vccmd03.googlecode.com/files/cmsys.gif#
https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black-300x117.png
https://reallyfreegeoip.org
https://zxq.net/wp-includes/wlwmanifest.xml
https://zxq.net/what-happened-to-the-old-zxq-website/Bs6
https://zxq.net/news/entertainment/
https://zxq.net/narrative-design-in-games-interactive-storytelling-vs-linear-storylines/
https://zxq.net/what-happened-to-the-old-zxq-website/qqC:
https://zxq.net/what-happened-to-the-old-zxq-website/#webpage
https://zxq.net/condo-design-ideas-for-a-conducive-work-environment/
https://zxq.net/wp-content/uploads/2025/02/Condo-Design-Ideas-for-a-Conducive-Work-Environment-450x2
https://zxq.net/wp-content/uploads/2025/02/4-Tips-for-Solo-Living-in-a-Condo-450x253.jpg
https://zxq.net/what-happened-to-the-old-zxq-website/?
https://zxq.net/?s=
https://zxq.net/wp-conten
http://www.carterandcone.coml
https://zxq.net/wp-content/plugins/table-of-contents-plus/screen.min.css?ver=2106
https://schema.org
http://checkip.dyndns.org
https://zxq.net/what-happened-to-the-old-zxq-website/ss%
http://crl.ver)
https://zxq.net/wp-content/uploads/2025/02/WHICH-HAIR-TRANSPLANT-METHOD-IS-BEST-FOR-YOU.png
https://yoast.com/wordpress/plugins/seo/
https://zxq.net/wp-content/uploads/2025/02/4-Tips-for-Solo-Living-in-a-Condo-768x432.jpg
https://zxq.net/?p=187
https://zxq.net/news/
https://zxq.net/what-happened-to-the-old-zxq-website/LMEMpX
https://zxq.net/xmlrpc.php?rsd
https://zxq.net/what-happened-to-the-old-zxq-website/er
https://zxq.net/wp-content/uploads/2025/02/AI-Agent-Crypto-Tokens-in-2025-Navigating-the-Hype-and-Re
http://www.goodfont.co.kr
http://www.tiro.com
http://tempuri.org/EchipamenteDataSet.xsd
https://zxq.net/cmsys.gifn/
http://www.fontbureau.com/designers?
https://zxq.net/wp-content/plugins/table-of-contents-plus/front.min.js?ver=2106
http://www.founder.com.cn/cn/bThe
http://www.fontbureau.com/designers/?
https://zxq.net/news/business/
http://vccmd03.googlecode.com/files/cmsys.gifN
http://www.fontbureau.com/designersG
https://zxq.net/wp-content/uploads/2022/03/follow-us-on-google-news-banner-black.png
https://zxq.net/wp-content/themes/smart-mag/css/icons/fonts/ts-icons.woff2?v2.2
https://zxq.net/cmsys.gife7
https://zxq.net/#organization
https://zxq.net/wp-content/uploads/2025/02/Narrative-Design-in-Games-Interactive-Storytelling-vs.-Li
https://zxq.net/wp-content/uploads/2025/02/Condo-Design-Ideas-for-a-Conducive-Work-Environment-1024x
https://zxq.net/wp-content/uploads/2025/02/Condo-Design-Ideas-for-a-Conducive-Work-Environment-300x1
https://zxq.net/wp-content/uploads/2025/02/WHICH-HAIR-TRANSPLANT-METHOD-IS-BEST-FOR-YOU-450x253.png
http://checkip.dyndns.org/
http://www.founder.com.cn/cn/cThe
https://g.live.com/odclientsettings/Prod.C:
http://www.sajatypeworks.com
https://zxq.net/cmsys.gife
https://zxq.net/wp-content/uploads/2025/01/Delayed-Injuries-After-a-Car-AS
https://zxq.net/cmsys.gifg
https://zxq.net/wp-content/uploads/2025/02/Condo-Design-Ideas-for-a-Conducive-Work-Environment-150x8
https://zxq.net/wp-content/uploads/2025/02/4-Tips-for-Solo-Living-in-a-Condo-300x169.jpg
http://www.fontbureau.com/designers
https://zxq.net/cmsys.gif_
https://reallyfreegeoip.org/xml/8.46.123.189l
https://g.live.com/odclientsettings/ProdV2.C:
http://reallyfreegeoip.orgd
https://zxq.net/what-happened-to-the-old-zxq-website/Cr5
https://zxq.net/wp-content/uploads/2025/01/Delayed-Injuries-After-a-Car-Accident-and-Why-They-Matter
https://zxq.net/what-happened-to-the-old-zxq-website/#breadcrumb
http://vccmd01.zxq.net/cmsys.giftbbub.exe
https://zxq.net/cmsys.gifn
https://reallyfreegeoip.org/xml/8.46.123.189
https://zxq.net/wp-content/uploads/2025/02/Condo-Design-Ideas-for-a-Conducive-Work-Environment-768x4
https://zxq.net/privacy-policy/
https://zxq.net/wp-content/uploads/2022/02/ZXQ-FB.png
https://zxq.net/what-happened-to-the-old-zxq-website/9r
https://zxq.net/what-happened-to-the-old-zxq-website/Rr
https://zxq.net/what-happened-to-the-old-zxq-website/)s
https://zxq.net/wp-content/uploads/2025/02/WHICH-HAIR-TRANSPLANT-METHOD-IS-BEST-FOR-YOU-1024x576.png
https://reallyfreegeoip.org/xml/
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
https://zxq.net/wp-json/
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
http://checkip.dyndns.org/d
http://www.zhongyicts.com.cn
http://www.urwpp.deDPlease
https://zxq.net/wp-content/themes/smart-mag/js/jquery.sticky-sidebar.js?ver=7.1.1
https://zxq.net/news/technology/
http://vccmd03.googlecode.com/files/cmsys.gif
https://zxq.net/what-happened-to-the-old-zxq-website/
http://www.galapagosdesign.com/DPlease
https://zxq.net/#logo
https://reallyfreegeoip.org/xml/8.46.123.189d
https://zxq.net/wp-content/uploads/2025/02/WHICH-HAIR-TRANSPLANT-METHOD-IS-BEST-FOR-YOU-150x84.png
https://zxq.net/what-happened-to-the-old-zxq-website/Qs
http://checkip.dyndns.org/q
https://zxq.net/ai-agent-crypto-tokens-in-2025-navigating-the-hype-and-reality/
https://zxq.net/cmsys.gif
https://zxq.net/about-us/
https://zxq.net/wp-content/uploads/2022/02/ZXQ.png

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\tmpF40C.tmp
XML 1.0 document, ASCII text
#
C:\Users\user\AppData\Local\icsys.icn.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\stsys.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
Click to see the 8 hidden entries
C:\Users\user\AppData\Roaming\ETBBUb.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Roaming\ETBBUb.exe:Zone.Identifier
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\etbbub.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Roaming\mrsys.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\Desktop\cerenak-8392.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Windows\System\explorer.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Windows\System\spoolsv.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Windows\System\svchost.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#