Analysis

  • max time kernel
    898s
  • max time network
    444s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260130-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    22/02/2026, 01:58

General

  • Target
    The-MALWARE-Repo-master/Trojan/Illerka.C.exe
  • Size 378KB
  • Sample260222-cdtt7sb16e
  • SHA256 cde188d6c4d6e64d6abfdea1e113314f9cdf9417bca36eb7201e6b766e5f5a7f
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • UAC bypass 3 TTPs 6 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Checks whether UAC is enabled 1 TTPs 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 53 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs
  • System policy modification 1 TTPs 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Illerka.C.exe
    "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Illerka.C.exe"
    1⤵
    • UAC bypass
    • Checks computer location settings
    • Checks whether UAC is enabled
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:5544
    • C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Mist\K04D27X5A36N6MT6R68.exe
      "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Mist\K04D27X5A36N6MT6R68.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      PID:3464
    • C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MrsMajors\X74L61V7I86I8QY1G41.exe
      "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MrsMajors\X74L61V7I86I8QY1G41.exe"
      2⤵
      • UAC bypass
      • Checks computer location settings
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5936
      • C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MrsMajors\BossDaMajor\M31G35Y5U12X5KU1M52.exe
        "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\MrsMajors\BossDaMajor\M31G35Y5U12X5KU1M52.exe"
        3⤵
        • UAC bypass
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • System policy modification
        PID:2216
    • C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Spark\W66S83R5U08K7IG1B00.exe
      "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Spark\W66S83R5U08K7IG1B00.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      PID:2708
    • C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\XCSSETMacMalware\O10N33Z5T85K7ZQ1N88.exe
      "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\XCSSETMacMalware\O10N33Z5T85K7ZQ1N88.exe"
      2⤵
      • UAC bypass
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • System policy modification
      PID:3216

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        O10N33Z5T85K7ZQ1N88.exe.log

        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\O10N33Z5T85K7ZQ1N88.exe.log
        • Size 594B
        • SHA256 9ed6b03949d6e7f38713d26dd5ef6923ddcea4bec4d6be46af231860356549c0
        • MD5 SHA1 SHA512 TLSH

        K04D27X5A36N6MT6R68.exe

        • Path C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Mist\K04D27X5A36N6MT6R68.exe
        • Size 378KB
        • SHA256 cde188d6c4d6e64d6abfdea1e113314f9cdf9417bca36eb7201e6b766e5f5a7f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        memory/2216-25-0x0000000005F20000-0x0000000005FF3000-memory.dmp

        memory/2708-17-0x0000000075560000-0x0000000075B11000-memory.dmp

        memory/2708-11-0x0000000075560000-0x0000000075B11000-memory.dmp

        memory/2708-16-0x0000000005D70000-0x0000000005E43000-memory.dmp

        memory/3216-21-0x0000000006CA0000-0x0000000006D73000-memory.dmp

        memory/3464-13-0x0000000005E00000-0x0000000005ED3000-memory.dmp

        memory/3464-14-0x0000000075560000-0x0000000075B11000-memory.dmp

        memory/3464-5-0x0000000075560000-0x0000000075B11000-memory.dmp

        memory/3464-3-0x0000000075560000-0x0000000075B11000-memory.dmp

        memory/5544-1-0x0000000075562000-0x0000000075564000-memory.dmp

        memory/5544-10-0x00000000066D0000-0x00000000067A3000-memory.dmp

        memory/5544-0-0x0000000001730000-0x0000000001740000-memory.dmp

        memory/5936-7-0x0000000075560000-0x0000000075B11000-memory.dmp

        memory/5936-22-0x0000000005A20000-0x0000000005AF3000-memory.dmp

        memory/5936-23-0x0000000075560000-0x0000000075B11000-memory.dmp