Trojan.DownLoader37.64594

Technical Information

Modifies file system

Creates the following files

%TEMP%\is-66dcs.tmp\<File name>.tmp
%ProgramFiles(x86)%\voluptatum\eveniet\is-t85sq.tmp
%ProgramFiles(x86)%\voluptatum\eveniet\is-umim2.tmp
%ProgramFiles(x86)%\voluptatum\eveniet\is-7bkgv.tmp
%ProgramFiles(x86)%\voluptatum\eveniet\is-kabf7.tmp
%ProgramFiles(x86)%\voluptatum\eveniet\is-c111t.tmp
%ProgramFiles(x86)%\voluptatum\eveniet\is-i5nq3.tmp
%ProgramFiles(x86)%\voluptatum\ea\is-5s3ic.tmp
%ProgramFiles(x86)%\voluptatum\ea\is-3srgs.tmp
%ProgramFiles(x86)%\voluptatum\ea\is-ppske.tmp
%ProgramFiles(x86)%\voluptatum\ea\is-vvk40.tmp
%ProgramFiles(x86)%\voluptatum\ea\is-jhgbc.tmp
%ProgramFiles(x86)%\voluptatum\ea\is-cb4k3.tmp
%ProgramFiles(x86)%\voluptatum\ea\is-50rtm.tmp
%ProgramFiles(x86)%\voluptatum\ea\is-83ps2.tmp
%ProgramFiles(x86)%\voluptatum\ea\is-3u9n6.tmp
%ProgramFiles(x86)%\voluptatum\is-s6rb2.tmp
%ProgramFiles(x86)%\voluptatum\is-o57qs.tmp
%ProgramFiles(x86)%\voluptatum\is-iaseg.tmp
%ProgramFiles(x86)%\voluptatum\is-d9552.tmp
%ProgramFiles(x86)%\voluptatum\is-bo2c1.tmp
%TEMP%\is-bmot9.tmp\_isetup\_iscrypt.dll
%TEMP%\is-bmot9.tmp\_isetup\_shfoldr.dll
%TEMP%\is-bmot9.tmp\_isetup\_setup64.tmp
%ProgramFiles(x86)%\voluptatum\eveniet\is-4rs0p.tmp
%ProgramFiles(x86)%\voluptatum\unins000.dat

Moves the following files

from %ProgramFiles(x86)%\voluptatum\is-bo2c1.tmp to %ProgramFiles(x86)%\voluptatum\unins000.exe
from %ProgramFiles(x86)%\voluptatum\eveniet\is-umim2.tmp to %ProgramFiles(x86)%\voluptatum\eveniet\quidem.bat
from %ProgramFiles(x86)%\voluptatum\eveniet\is-7bkgv.tmp to %ProgramFiles(x86)%\voluptatum\eveniet\ipsa.hta
from %ProgramFiles(x86)%\voluptatum\eveniet\is-kabf7.tmp to %ProgramFiles(x86)%\voluptatum\eveniet\eos.mp3
from %ProgramFiles(x86)%\voluptatum\eveniet\is-c111t.tmp to %ProgramFiles(x86)%\voluptatum\eveniet\consequatur.log
from %ProgramFiles(x86)%\voluptatum\eveniet\is-i5nq3.tmp to %ProgramFiles(x86)%\voluptatum\eveniet\asperiores.sdf
from %ProgramFiles(x86)%\voluptatum\ea\is-5s3ic.tmp to %ProgramFiles(x86)%\voluptatum\ea\sqlite3.dll
from %ProgramFiles(x86)%\voluptatum\ea\is-3srgs.tmp to %ProgramFiles(x86)%\voluptatum\ea\soluta.htm
from %ProgramFiles(x86)%\voluptatum\ea\is-ppske.tmp to %ProgramFiles(x86)%\voluptatum\ea\sit.bin
from %ProgramFiles(x86)%\voluptatum\eveniet\is-t85sq.tmp to %ProgramFiles(x86)%\voluptatum\eveniet\sequi.log
from %ProgramFiles(x86)%\voluptatum\ea\is-vvk40.tmp to %ProgramFiles(x86)%\voluptatum\ea\reiciendis.mp4
from %ProgramFiles(x86)%\voluptatum\ea\is-cb4k3.tmp to %ProgramFiles(x86)%\voluptatum\ea\eum.wpd
from %ProgramFiles(x86)%\voluptatum\ea\is-50rtm.tmp to %ProgramFiles(x86)%\voluptatum\ea\est.rar
from %ProgramFiles(x86)%\voluptatum\ea\is-83ps2.tmp to %ProgramFiles(x86)%\voluptatum\ea\eos.pif
from %ProgramFiles(x86)%\voluptatum\ea\is-3u9n6.tmp to %ProgramFiles(x86)%\voluptatum\ea\cumque.exe
from %ProgramFiles(x86)%\voluptatum\is-s6rb2.tmp to %ProgramFiles(x86)%\voluptatum\provident.key
from %ProgramFiles(x86)%\voluptatum\is-o57qs.tmp to %ProgramFiles(x86)%\voluptatum\non.txt
from %ProgramFiles(x86)%\voluptatum\is-iaseg.tmp to %ProgramFiles(x86)%\voluptatum\dolores.pif
from %ProgramFiles(x86)%\voluptatum\is-d9552.tmp to %ProgramFiles(x86)%\voluptatum\autem.pps
from %ProgramFiles(x86)%\voluptatum\ea\is-jhgbc.tmp to %ProgramFiles(x86)%\voluptatum\ea\impedit.sdf
from %ProgramFiles(x86)%\voluptatum\eveniet\is-4rs0p.tmp to %ProgramFiles(x86)%\voluptatum\eveniet\sit.rar

Network activity

TCP

HTTP POST requests

http://cl###etapi.com/v2/events

UDP

DNS ASK cl###etapi.com

Miscellaneous

Searches for the following windows

ClassName: 'B54438F9-015B-469E-ABA7-B99A25458983' WindowName: ''

Creates and executes the following

'%TEMP%\is-66dcs.tmp\<File name>.tmp' /SL5="$B022E,3425703,140800,<Full path to file>"
'%ProgramFiles(x86)%\voluptatum\ea\cumque.exe' 74655fb83ca3db33abd764b9a988fbcc