IOC Report
CIQ-PO16266.js

CIQ-PO16266.js

ASCII text, with very long lines

initial sample

C:\Program Files (x86)\Clf0t8l5h\oxx7nkdv4g8.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\Clf0t8l5h\oxx7nkdv4g8.exe

PE32 executable (GUI) Intel 80386, for MS Windows

dropped

C:\Users\user\AppData\Local\Temp\bin.exe

PE32 executable (GUI) Intel 80386, for MS Windows

modified

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtheeNaAZG.js

ASCII text, with very long lines

dropped

C:\Users\user\AppData\Roaming\wtheeNaAZG.js

ASCII text, with very long lines

dropped

C:\Windows\System32\wscript.exe

C:\Windows\System32\wscript.exe "C:\Users\user\Desktop\CIQ-PO16266.js"

C:\Windows\System32\wscript.exe

C:\Windows\System32\wscript.exe" //B "C:\Users\user\AppData\Roaming\wtheeNaAZG.js

C:\Users\user\AppData\Local\Temp\bin.exe

"C:\Users\user\AppData\Local\Temp\bin.exe"

C:\Windows\explorer.exe

C:\Windows\Explorer.EXE

C:\Windows\System32\wscript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wtheeNaAZG.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\wtheeNaAZG.js"

C:\Windows\System32\wscript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wtheeNaAZG.js"

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\SysWOW64\cmd.exe

/c del "C:\Users\user\AppData\Local\Temp\bin.exe"

C:\Windows\SysWOW64\cmd.exe

/c copy "C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\user\AppData\Local\Temp\DB1" /V

http://www.ratebill.com/np8s/

137.220.133.198

http://dilshadkhan.duia.ro:6670/VredmFyIGN0

unknown

http://dilshadkhan.duia.ro:6670/Vrext10

unknown

http://dilshadkhan.duia.ro:6670/Vre$s

unknown

http://www.refreshertowels.com/np8s/?zVB=MO+mSdLLrNuwRQYoVJuGLv0I5Vniy3FD6QWfbcj4un1GXTVLdefusF8/o4IGo+fIW5Ou&4hM4=o4B0f

23.231.99.207

http://dilshadkhan.duia.ro:6670/Vre-Agent((

unknown

http://dilshadkhan.duia.ro:6670/VrebWcgPSAi

unknown

http://dilshadkhan.duia.ro:6670/VreMw

unknown

http://dilshadkhan.duia.ro:6670/Vreadkhan.duum

unknown

http://www.refreshertowels.com/np8s/?zVB=MO+mSdLLrNuwRQYoVJuGLv0I5Vniy3FD6QWfbcj4un1GXTVLdefusF8/o4IGo+fIW5Ou&CTr8g=z48HVPSHfp

23.231.99.207