Resubmissions
15/11/2025, 04:13
251115-etlvmswpbl1006/08/2025, 06:38
250806-hejcrawl191031/07/2025, 14:44
250731-r4fgtsbk8t1009/06/2025, 11:40
250609-nsz6bazmv209/06/2025, 00:25
250609-aqmwbatmt43Analysis
- max time kernel
149s - max time network
104s - platform
windows11-21h2_x64 - resource
win11-20251015-en - resource tags
- submitted
15/11/2025, 04:13
General
- Target ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a.exe
- Size 689KB
- Sample251115-etlvmswpbl
- SHA256 ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a
Score
10/10
Malware Config
Signatures
- Detects DuplexSpyRAT 1 IoCs
- DuplexSpyRAT
DuplexSpyRAT is an open-source Remote Access Tool written in C#.
- Duplexspyrat family
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a.exe"C:\Users\Admin\AppData\Local\Temp\ab036cc442800d2d71a3baa9f2d6b27e3813b9f740d7c3e7635b84e3e7a8d66a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4120-0-0x0000000000430000-0x00000000004E0000-memory.dmp
memory/4120-1-0x0000000005540000-0x0000000005AE6000-memory.dmp
memory/4120-2-0x0000000004F90000-0x0000000005022000-memory.dmp
memory/4120-3-0x00000000050D0000-0x00000000050E0000-memory.dmp
memory/4120-4-0x0000000004F70000-0x0000000004F7A000-memory.dmp
memory/4120-5-0x00000000050D0000-0x00000000050E0000-memory.dmp
memory/4120-6-0x00000000082F0000-0x0000000008356000-memory.dmp