Analysis
- user interaction
yes - max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
12/10/2026, 14:54
General
- Target sample.exe
- Size 1.4MB
- Sample261012-r9yklasz3k
- SHA256 3cb95de50a1ded37cfd4166fc6fde198339bff450802f3f525a8a4784acb52be
Malware Config
Extracted
-
netwire
-
Wealthy2019.com.strangled.net:20190
-
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
-
warzonerat
-
wealth.warzonedns.com:5202
Signatures
Processes
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"1⤵
-
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\sample.exe"C:\Users\Admin\AppData\Local\Temp\sample.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
Blasthost.exe
RtDCpl64.exe
memory/1480-34-0x0000000000A90000-0x0000000000A91000-memory.dmp
memory/2072-107-0x0000000001340000-0x0000000001341000-memory.dmp
memory/2792-73-0x0000000000B20000-0x0000000000C8B000-memory.dmp
memory/2792-62-0x0000000000B20000-0x0000000000C8B000-memory.dmp
memory/2856-55-0x0000000000400000-0x000000000042C000-memory.dmp
memory/2856-16-0x0000000000400000-0x000000000042C000-memory.dmp
memory/2856-57-0x0000000000400000-0x000000000042C000-memory.dmp
memory/2928-94-0x0000000000B20000-0x0000000000C8B000-memory.dmp
memory/2928-106-0x0000000000B20000-0x0000000000C8B000-memory.dmp
memory/3168-58-0x0000000000400000-0x000000000042C000-memory.dmp
memory/3504-51-0x0000000000B20000-0x0000000000C8B000-memory.dmp
memory/3504-42-0x0000000000400000-0x000000000041D000-memory.dmp
memory/3504-50-0x0000000000400000-0x000000000041D000-memory.dmp
memory/3520-132-0x0000000000B20000-0x0000000000C8B000-memory.dmp
memory/3520-145-0x0000000000B20000-0x0000000000C8B000-memory.dmp
memory/3936-15-0x0000000000400000-0x000000000042C000-memory.dmp
memory/3936-11-0x0000000000429000-0x000000000042A000-memory.dmp
memory/3944-53-0x00000000005E0000-0x00000000005E1000-memory.dmp
memory/4124-112-0x0000000000400000-0x000000000042C000-memory.dmp
memory/4180-78-0x0000000000400000-0x000000000042C000-memory.dmp
memory/4704-28-0x0000000000C80000-0x0000000000DEB000-memory.dmp
memory/4704-0-0x0000000000C80000-0x0000000000DEB000-memory.dmp
memory/4704-17-0x0000000000EE0000-0x0000000000EE1000-memory.dmp
memory/4704-1-0x0000000000C80000-0x0000000000DEB000-memory.dmp
memory/4852-26-0x00000000000F0000-0x000000000010D000-memory.dmp
memory/4852-18-0x00000000000F0000-0x000000000010D000-memory.dmp
memory/4876-74-0x0000000000F90000-0x0000000000F91000-memory.dmp
memory/5080-52-0x0000000000B20000-0x0000000000C8B000-memory.dmp
memory/5080-30-0x0000000000B20000-0x0000000000C8B000-memory.dmp
memory/5080-31-0x0000000000B20000-0x0000000000C8B000-memory.dmp