edb1ff25...3eb9 | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 97/100
Target: win7_32_sp1 | exe
Classification: Trojan, Dropper, Pua

edb1ff2521fb4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9 (SHA256)

OlympicDestroyer.exe

Windows Exe (x86-32)

Created at 2018-03-15 15:14:00

...

Notifications (1/1)

The overall sleep time of all monitored processes was truncated from "1 hour" to "10 seconds" to reveal dormant functionality.

Indicators

File (22)
»
Filename Hash Operations
\\.\pipe\7DE670E9-B7B8-48DA-BA85-FF4203050C88 - Access, Write
\\.\pipe\DDC210D0-5FCE-4636-B79C-32457B89BBE4 - Access, Write
c:\7C2313D39DB657EA92ADAAF39716AECE - Access
C:\Users\EEBsYm5\AppData\Local\Google\Chrome\User Data\Default\Login Data - Access
C:\Users\EEBsYm5\AppData\Local\Temp\_aaq.exe MD5: 3c0d740347b0362331c882c2dee96dbf
SHA1: 8350e06f52e5c660bb416b03edb6a5ddc50c3a59
SHA256: ae9a4e244a9b3c77d489dee8aeaf35a7c3ba31b210e76d81ef2e91790f052c85 		Access, Write
C:\Users\EEBsYm5\AppData\Local\Temp\_kog.exe MD5: 27304b246c7d5b4e149124d5f93c5b01
SHA1: e50d9e3bd91908e13a26b3e23edeaf577fb3a095
SHA256: 3337e3875b05e0bfba69ab926532e3f179e8cfbf162ebb60ce58a0281437a7ef 		Access, Write
C:\Users\EEBsYm5\AppData\Local\Temp\_tqo.exe MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		Access, Read
C:\Users\EEBsYm5\AppData\Local\Temp\chr79E0.tmp MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		Access, Read
C:\Users\EEBsYm5\AppData\Local\Temp\chr79E0.tmp-journal - Access
C:\Users\EEBsYm5\AppData\Local\Temp\chr79E0.tmp-wal - Access
C:\Users\EEBsYm5\AppData\Local\Temp\ilvai.exe MD5: 6e0ebeeea1cb00192b074b288a4f9cfe
SHA1: 21ca710ed3bc536bd5394f0bff6d6140809156cf
SHA256: a52af66a4438c5517870c503ac1e0515af44d3994aa62c7d818b6eef46cfbb2d 		Access, Read, Write
C:\Users\EEBsYm5\AppData\Local\Temp\xtbrb.exe MD5: 4f43f03783f9789f804dcf9b9474fa6d
SHA1: 492d4a4a74099074e26b5dffd0d15434009ccfd9
SHA256: 19ab44a1343db19741b0e0b06bacce55990b6c8f789815daaf3476e0cc30ebea 		Access, Write
C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\\logins.json - Access
C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\signons.sqlite - Access, Read
C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\signons.sqlite-journal - Access
C:\Users\EEBsYm5\AppData\Roaming\Mozilla\Firefox\Profiles\h231daer.default\signons.sqlite-wal - Access
C:\Users\EEBsYm5\Desktop - Access
bcdedit.exe - Access
C:\Users\EEBsYm5\Desktop\OlympicDestroyer.exe - Access
wbadmin.exe - Access
wevtutil.exe - Access
C:\Users\Public\5712465812CBDDBC332DE65CBAAAF3EB MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 		Access
Registry (19)
»
Registry Key Name Operations
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access, Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40 Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox 25.0 (x86 en-US) Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access, Read
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image