Analysis date (UTC): 6 April 2020, 10:52Analysis environment: Windows 7 Pro, build 7601, x86

1b1279f4eca61a6661eb687cba8566b20fdc0cfa17bed09a6c0b87d53e7055dd

MD5:7874A9E692CF3AF5F2C6AE05A079B324

SHA1:2D6720AE866875B42601951EB3C9421FA2D5B7F0

SHA256:1B1279F4ECA61A6661EB687CBA8566B20FDC0CFA17BED09A6C0B87D53E7055DD

Analysis result

Threat level:Malicious activity

Tags:

ratremcoskeylogger

1b1279f4eca61a6661eb687cba8566b20fdc0cfa17bed09a6c0b87d53e7055dd.exe (PID: 3772)
firefoxx.exe (PID: 2140)

firefoxx.exe (PID: 2140)
1b1279f4eca61a6661eb687cba8566b20fdc0cfa17bed09a6c0b87d53e7055dd.exe (PID: 3772)

1b1279f4eca61a6661eb687cba8566b20fdc0cfa17bed09a6c0b87d53e7055dd.exe (PID: 1064)
firefoxx.exe (PID: 3076)

1b1279f4eca61a6661eb687cba8566b20fdc0cfa17bed09a6c0b87d53e7055dd.exe (PID: 3772)
firefoxx.exe (PID: 2140)

1b1279f4eca61a6661eb687cba8566b20fdc0cfa17bed09a6c0b87d53e7055dd.exe (PID: 3772)

firefoxx.exe (PID: 2140)
1b1279f4eca61a6661eb687cba8566b20fdc0cfa17bed09a6c0b87d53e7055dd.exe (PID: 3772)

1b1279f4eca61a6661eb687cba8566b20fdc0cfa17bed09a6c0b87d53e7055dd.exe (PID: 3772)

firefoxx.exe (PID: 2140)
1b1279f4eca61a6661eb687cba8566b20fdc0cfa17bed09a6c0b87d53e7055dd.exe (PID: 3772)

1b1279f4eca61a6661eb687cba8566b20fdc0cfa17bed09a6c0b87d53e7055dd.exe (PID: 3772)

PID	Process	Class	Message
3772	1b1279f4eca61a6661eb687cba8566b20fdc0cfa17bed09a6c0b87d53e7055dd.exe	A Network Trojan was detected	MALWARE [PTsecurity] EJNT_Loader
3772	1b1279f4eca61a6661eb687cba8566b20fdc0cfa17bed09a6c0b87d53e7055dd.exe	A Network Trojan was detected	MALWARE [PTsecurity] EJNT_Loader
2140	firefoxx.exe	A Network Trojan was detected	MALWARE [PTsecurity] EJNT_Loader
2140	firefoxx.exe	A Network Trojan was detected	MALWARE [PTsecurity] EJNT_Loader
1052	svchost.exe	Potentially Bad Traffic	ET POLICY DNS Query to DynDNS Domain *.ddns .net