Resubmissions
15/11/2025, 04:13
251115-etlvmswpbl1006/08/2025, 06:38
250806-hejcrawl191031/07/2025, 14:44
250731-r4fgtsbk8t1009/06/2025, 11:40
250609-nsz6bazmv209/06/2025, 00:25
250609-aqmwbatmt43Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20251016-en - resource tags
- submitted
15/11/2025, 04:13
General
- Target ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a.exe
- Size 689KB
- Sample251115-etlvmswpbl
- SHA256 ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a
Score
10/10
Malware Config
Signatures
- Detects DuplexSpyRAT 1 IoCs
- DuplexSpyRAT
DuplexSpyRAT is an open-source Remote Access Tool written in C#.
- Duplexspyrat family
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a.exe"C:\Users\Admin\AppData\Local\Temp\ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4480-0-0x00000000006F0000-0x00000000007A0000-memory.dmp
memory/4480-1-0x0000000005760000-0x0000000005D04000-memory.dmp
memory/4480-2-0x00000000051B0000-0x0000000005242000-memory.dmp
memory/4480-3-0x0000000005320000-0x0000000005330000-memory.dmp
memory/4480-4-0x0000000005180000-0x000000000518A000-memory.dmp
memory/4480-5-0x0000000005320000-0x0000000005330000-memory.dmp
memory/4480-6-0x0000000006620000-0x0000000006686000-memory.dmp