Analysis
- max time kernel
146s - max time network
102s - platform
windows11-21h2_x64 - resource
win11-20250619-en - resource tags
- submitted
25/08/2025, 02:13
General
- Target 639cdac320e40ccc0b7da170dad155a8180076afdac60eef4c3638c09f52d50c.exe
- Size 850KB
- Sample250825-cnsd5azzcx
- SHA256 639cdac320e40ccc0b7da170dad155a8180076afdac60eef4c3638c09f52d50c
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 24 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\639cdac320e40ccc0b7da170dad155a8180076afdac60eef4c3638c09f52d50c.exe"C:\Users\Admin\AppData\Local\Temp\639cdac320e40ccc0b7da170dad155a8180076afdac60eef4c3638c09f52d50c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\xbmqvxc.exeC:\Users\Admin\AppData\Local\Temp\xbmqvxc.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 7282⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 7362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4364 -ip 43641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4364 -ip 43641⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
vkxycjf
xbmqvxc.exe
memory/836-3361-0x00000000154C0000-0x0000000015537000-memory.dmp
memory/836-230-0x00000000154C0000-0x0000000015537000-memory.dmp
memory/836-45-0x00000000154C0000-0x0000000015537000-memory.dmp
memory/836-48-0x00000000154C0000-0x0000000015537000-memory.dmp
memory/836-27-0x00000000154C0000-0x0000000015537000-memory.dmp
memory/836-29-0x00000000154C0000-0x0000000015537000-memory.dmp
memory/836-24-0x00000000154C0000-0x0000000015537000-memory.dmp
memory/836-23-0x00000000154C0000-0x0000000015537000-memory.dmp
memory/836-21-0x00000000154C0000-0x0000000015537000-memory.dmp
memory/2344-6-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/2344-11-0x0000000003B10000-0x0000000003D5B000-memory.dmp
memory/2344-10-0x00000000038F0000-0x0000000003B0A000-memory.dmp
memory/2344-8-0x0000000000400000-0x00000000004DB000-memory.dmp
memory/2344-7-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/2344-0-0x00000000031C0000-0x00000000032F0000-memory.dmp
memory/2344-5-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/2344-4-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/2344-3-0x00000000031C0000-0x00000000032F0000-memory.dmp
memory/2344-2-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/2344-1-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/4364-15-0x0000000000400000-0x00000000004DB000-memory.dmp
memory/4364-18-0x0000000002510000-0x000000000275B000-memory.dmp