Overview
overview
10Static
static
10The-MALWAR...er.zip
windows10-ltsc_2021-x64
1The-MALWAR...00.exe
windows10-ltsc_2021-x64
The-MALWAR...ta.exe
windows10-ltsc_2021-x64
3The-MALWAR...na.exe
windows10-ltsc_2021-x64
The-MALWAR...mb.exe
windows10-ltsc_2021-x64
5The-MALWAR...en.exe
windows10-ltsc_2021-x64
5The-MALWAR...bi.vbs
windows10-ltsc_2021-x64
10The-MALWAR...mr.vbs
windows10-ltsc_2021-x64
4The-MALWAR...ll.exe
windows10-ltsc_2021-x64
6The-MALWAR...ug.exe
windows10-ltsc_2021-x64
6The-MALWAR...le.exe
windows10-ltsc_2021-x64
3The-MALWAR...an.bat
windows10-ltsc_2021-x64
1The-MALWAR...er.exe
windows10-ltsc_2021-x64
3The-MALWAR...n.docx
windows10-ltsc_2021-x64
1The-MALWAR...er.exe
windows10-ltsc_2021-x64
7The-MALWAR...as.exe
windows10-ltsc_2021-x64
3The-MALWAR...ve.apk
windows10-ltsc_2021-x64
3The-MALWAR...er.exe
windows10-ltsc_2021-x64
The-MALWAR...ce.exe
windows10-ltsc_2021-x64
3The-MALWAR....C.exe
windows10-ltsc_2021-x64
10The-MALWAR...Lz.bat
windows10-ltsc_2021-x64
8The-MALWAR...ou.exe
windows10-ltsc_2021-x64
3The-MALWAR...MZ.exe
windows10-ltsc_2021-x64
7The-MALWAR...um.apk
windows10-ltsc_2021-x64
3The-MALWAR...st.exe
windows10-ltsc_2021-x64
8The-MALWAR...er.exe
windows10-ltsc_2021-x64
8The-MALWAR...RC.exe
windows10-ltsc_2021-x64
8The-MALWAR...re.apk
windows10-ltsc_2021-x64
3The-MALWAR...or.exe
windows10-ltsc_2021-x64
The-MALWAR....0.exe
windows10-ltsc_2021-x64
10The-MALWAR...z.html
windows10-ltsc_2021-x64
4The-MALWAR...er.exe
windows10-ltsc_2021-x64
Analysis
- max time kernel
898s - max time network
444s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
22/02/2026, 01:58
Static task
static1
Behavioral task
behavioral1
Sample
The-MALWARE-Repo-master.zip
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral2
Sample
The-MALWARE-Repo-master/Trojan/000.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral3
Sample
The-MALWARE-Repo-master/Trojan/Alerta.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral4
Sample
The-MALWARE-Repo-master/Trojan/Ana.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral5
Sample
The-MALWARE-Repo-master/Trojan/ArcticBomb.exe
Resource
win10ltsc2021-20260126-en
Behavioral task
behavioral6
Sample
The-MALWARE-Repo-master/Trojan/BlueScreen.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral7
Sample
The-MALWARE-Repo-master/Trojan/Bolbi.vbs
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral8
Sample
The-MALWARE-Repo-master/Trojan/Carewmr.vbs
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral9
Sample
The-MALWARE-Repo-master/Trojan/ClassicShell.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral10
Sample
The-MALWARE-Repo-master/Trojan/ColorBug.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral11
Sample
The-MALWARE-Repo-master/Trojan/DesktopPuzzle.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral12
Sample
The-MALWARE-Repo-master/Trojan/DudleyTrojan.bat
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral13
Sample
The-MALWARE-Repo-master/Trojan/FlashKiller.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral14
Sample
The-MALWARE-Repo-master/Trojan/Frankenstein.docx
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral15
Sample
The-MALWARE-Repo-master/Trojan/FreeYoutubeDownloader.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral16
Sample
The-MALWARE-Repo-master/Trojan/Gas.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral17
Sample
The-MALWARE-Repo-master/Trojan/Grave.apk
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral18
Sample
The-MALWARE-Repo-master/Trojan/HMBlocker.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral19
Sample
The-MALWARE-Repo-master/Trojan/IconDance.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral20
Sample
The-MALWARE-Repo-master/Trojan/Illerka.C.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral21
Sample
The-MALWARE-Repo-master/Trojan/L0Lz.bat
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral22
Sample
The-MALWARE-Repo-master/Trojan/LoveYou.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral23
Sample
The-MALWARE-Repo-master/Trojan/MEMZ.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral24
Sample
The-MALWARE-Repo-master/Trojan/Malum.apk
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral25
Sample
The-MALWARE-Repo-master/Trojan/Mist/MistInfected_newest.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral26
Sample
The-MALWARE-Repo-master/Trojan/Mist/MistInstaller.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral27
Sample
The-MALWARE-Repo-master/Trojan/Mist/MistInstallerRC.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral28
Sample
The-MALWARE-Repo-master/Trojan/Mobile_Legends_Adventure.apk
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral29
Sample
The-MALWARE-Repo-master/Trojan/MrsMajors/BossDaMajor/BossDaMajor.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral30
Sample
The-MALWARE-Repo-master/Trojan/MrsMajors/MrsMajor3.0.exe
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral31
Sample
The-MALWARE-Repo-master/Trojan/Offiz.html
Resource
win10ltsc2021-20260130-en
Behavioral task
behavioral32
Sample
The-MALWARE-Repo-master/Trojan/PCToaster.exe
Resource
win10ltsc2021-20260130-en
General
- Target The-MALWARE-Repo-master/Trojan/Illerka.C.exe
- Size 378KB
- Sample260222-cdtt7sb16e
- SHA256 cde188d6c4d6e64d6abfdea1e113314f9cdf9417bca36eb7201e6b766e5f5a7f
- MD5 c718a1cbf0e13674714c66694be02421
- SHA1 001d5370d3a7ee48db6caaecb1c213b5dfdf8e65
- SHA512 ba0ddff47b618740dfcb63024435c36d895889dd3cf6b4559969283ba8100e8063f5c7767e56dfab67a2b5c96e4ae22e141e5b09e81be5cec9aa7ca7827b4b8a
- SSDEEP 1536:IM64RFcdoYicOWtlo4yJDsE4KmtZxq3/1d+DSaumOY6eeLnAGTpZspibfaSuOypE:IMJkoY9lpoaKm2vacPESu/wK3+
- TLSH T17D84F726092CDC0ED26078F896B0E5AEE07CDE040D6E5464D7B7BD9A8938B5FED1C18D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UAC bypass 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Illerka.C.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" K04D27X5A36N6MT6R68.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" W66S83R5U08K7IG1B00.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" O10N33Z5T85K7ZQ1N88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" X74L61V7I86I8QY1G41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" M31G35Y5U12X5KU1M52.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\International\Geo\Nation Illerka.C.exe Key value queried \REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000\Control Panel\International\Geo\Nation X74L61V7I86I8QY1G41.exe - Executes dropped EXE 5 IoCs
pid Process 3464 K04D27X5A36N6MT6R68.exe 5936 X74L61V7I86I8QY1G41.exe 2708 W66S83R5U08K7IG1B00.exe 3216 O10N33Z5T85K7ZQ1N88.exe 2216 M31G35Y5U12X5KU1M52.exe - Checks whether UAC is enabled 1 TTPs 12 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Illerka.C.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Illerka.C.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA K04D27X5A36N6MT6R68.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" K04D27X5A36N6MT6R68.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" O10N33Z5T85K7ZQ1N88.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA X74L61V7I86I8QY1G41.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA M31G35Y5U12X5KU1M52.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA W66S83R5U08K7IG1B00.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" W66S83R5U08K7IG1B00.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA O10N33Z5T85K7ZQ1N88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" X74L61V7I86I8QY1G41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" M31G35Y5U12X5KU1M52.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language K04D27X5A36N6MT6R68.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language X74L61V7I86I8QY1G41.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language W66S83R5U08K7IG1B00.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language O10N33Z5T85K7ZQ1N88.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language M31G35Y5U12X5KU1M52.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Illerka.C.exe - Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 5544 Illerka.C.exe 3464 K04D27X5A36N6MT6R68.exe 2708 W66S83R5U08K7IG1B00.exe 3464 K04D27X5A36N6MT6R68.exe 3216 O10N33Z5T85K7ZQ1N88.exe 5936 X74L61V7I86I8QY1G41.exe 3464 K04D27X5A36N6MT6R68.exe 2708 W66S83R5U08K7IG1B00.exe 5936 X74L61V7I86I8QY1G41.exe 3216 O10N33Z5T85K7ZQ1N88.exe 5936 X74L61V7I86I8QY1G41.exe 3216 O10N33Z5T85K7ZQ1N88.exe 3216 O10N33Z5T85K7ZQ1N88.exe 2216 M31G35Y5U12X5KU1M52.exe - Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 5544 Illerka.C.exe Token: SeDebugPrivilege 3464 K04D27X5A36N6MT6R68.exe Token: SeDebugPrivilege 2708 W66S83R5U08K7IG1B00.exe Token: SeDebugPrivilege 3216 O10N33Z5T85K7ZQ1N88.exe Token: SeDebugPrivilege 5936 X74L61V7I86I8QY1G41.exe Token: SeDebugPrivilege 2216 M31G35Y5U12X5KU1M52.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5544 wrote to memory of 3464 5544 Illerka.C.exe 86 PID 5544 wrote to memory of 5936 5544 Illerka.C.exe 87 PID 5544 wrote to memory of 2708 5544 Illerka.C.exe 88 PID 5544 wrote to memory of 3216 5544 Illerka.C.exe 89 PID 5936 wrote to memory of 2216 5936 X74L61V7I86I8QY1G41.exe 91 - System policy modification 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Illerka.C.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" K04D27X5A36N6MT6R68.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" W66S83R5U08K7IG1B00.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" O10N33Z5T85K7ZQ1N88.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" X74L61V7I86I8QY1G41.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" M31G35Y5U12X5KU1M52.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Illerka.C.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Illerka.C.exe"1⤵
- UAC bypass
- Checks computer location settings
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5544 -
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Mist\K04D27X5A36N6MT6R68.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Mist\K04D27X5A36N6MT6R68.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3464
-
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MrsMajors\X74L61V7I86I8QY1G41.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MrsMajors\X74L61V7I86I8QY1G41.exe"2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5936 -
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MrsMajors\BossDaMajor\M31G35Y5U12X5KU1M52.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MrsMajors\BossDaMajor\M31G35Y5U12X5KU1M52.exe"3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2216
-
-
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Spark\W66S83R5U08K7IG1B00.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Spark\W66S83R5U08K7IG1B00.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2708
-
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\XCSSETMacMalware\O10N33Z5T85K7ZQ1N88.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\XCSSETMacMalware\O10N33Z5T85K7ZQ1N88.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3216
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\O10N33Z5T85K7ZQ1N88.exe.log
- Size 594B
- SHA256 9ed6b03949d6e7f38713d26dd5ef6923ddcea4bec4d6be46af231860356549c0
- MD5 8f49714f5c52570470212f090865ca42
- SHA1 5787bdd191f7f9fd6d235e906d8d7079a610c6cf
- SHA512 36e83fe465a214cfd19d23120b2603d649330a065b20197952f99d579af0ea1cf6717972cd09abc267ec11e12e803017c74f2173b17aafbc49d65c2f04b0cc65
- TLSH T15BF08B30353294C90E202B110C10BFDA62EF471A7BB89F0C6A52134DEE2A447D7022F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Mist\K04D27X5A36N6MT6R68.exe
- Size 378KB
- SHA256 cde188d6c4d6e64d6abfdea1e113314f9cdf9417bca36eb7201e6b766e5f5a7f
- MD5 c718a1cbf0e13674714c66694be02421
- SHA1 001d5370d3a7ee48db6caaecb1c213b5dfdf8e65
- SHA512 ba0ddff47b618740dfcb63024435c36d895889dd3cf6b4559969283ba8100e8063f5c7767e56dfab67a2b5c96e4ae22e141e5b09e81be5cec9aa7ca7827b4b8a
- SSDEEP 1536:IM64RFcdoYicOWtlo4yJDsE4KmtZxq3/1d+DSaumOY6eeLnAGTpZspibfaSuOypE:IMJkoY9lpoaKm2vacPESu/wK3+
- TLSH T17D84F726092CDC0ED26078F896B0E5AEE07CDE040D6E5464D7B7BD9A8938B5FED1C18D
- MD5 SHA1 SHA512 SSDEEP TLSH