dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 08:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
Size 9.6MB
Sample260415-kstrrac19s
SHA256 dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1
MD5 15dfd82c59174e44292da29db54a4ff9
SHA1 61b86d702f886c7a0be09d026c4b327473fdeb3f
SHA512 60ab002027b72e9d249e646c1fd3302447c7e82391828052d9f6a376c06820d4f35ae5142606bfca72ed1288d4bb342dfd905c7fd74f1d9ec72e123ac8ebad06
SSDEEP 196608:CbcOli2XykeihBWeFXy+IFTYMjcVfx3yJ+KGxr2cqu:CQ9NHcBWeFXOlRjSQJglr1
TLSH
T126A6F133F18270B5D0E42030616A7BBB763872164B0D99FBD397AEFC2A351D0666B356
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion discovery privilege_escalation upx

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 644 set thread context of 4256	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	103

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/644-12-0x0000000002DC0000-0x0000000002DE7000-memory.dmp	upx
behavioral2/memory/644-15-0x0000000002DC0000-0x0000000002DE7000-memory.dmp	upx
behavioral2/memory/644-24-0x0000000003190000-0x00000000031B7000-memory.dmp	upx
behavioral2/memory/644-29-0x0000000003190000-0x00000000031B7000-memory.dmp	upx
behavioral2/memory/644-64-0x0000000002DC0000-0x0000000002DE7000-memory.dmp	upx
behavioral2/memory/644-70-0x0000000003190000-0x00000000031B7000-memory.dmp	upx
behavioral2/memory/4256-77-0x0000000003210000-0x0000000003237000-memory.dmp	upx
behavioral2/memory/4256-84-0x0000000003270000-0x0000000003297000-memory.dmp	upx

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
1992	runas.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	diskusage.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1916	RpcPing.exe

Runs regedit.exe 1 IoCs

pid	Process
2524	regedit.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
Token: SeDebugPrivilege	4256	diskusage.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe
4256	diskusage.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 8	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	79
PID 644 wrote to memory of 4992	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	80
PID 644 wrote to memory of 4068	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	81
PID 644 wrote to memory of 3872	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	82
PID 644 wrote to memory of 4168	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	83
PID 644 wrote to memory of 3788	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	84
PID 644 wrote to memory of 3104	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	85
PID 644 wrote to memory of 4740	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	86
PID 644 wrote to memory of 4408	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	87
PID 644 wrote to memory of 1916	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	88
PID 644 wrote to memory of 2524	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	89
PID 644 wrote to memory of 1960	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	90
PID 644 wrote to memory of 2108	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	91
PID 644 wrote to memory of 1932	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	92
PID 644 wrote to memory of 2020	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	93
PID 644 wrote to memory of 2444	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	94
PID 644 wrote to memory of 1992	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	95
PID 644 wrote to memory of 1244	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	96
PID 644 wrote to memory of 4668	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	97
PID 644 wrote to memory of 1692	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	98
PID 644 wrote to memory of 5100	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	99
PID 644 wrote to memory of 2808	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	100
PID 644 wrote to memory of 1784	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	101
PID 644 wrote to memory of 4832	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	102
PID 644 wrote to memory of 4256	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	103
PID 644 wrote to memory of 4256	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	103
PID 644 wrote to memory of 4256	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	103
PID 644 wrote to memory of 4256	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	103
PID 644 wrote to memory of 4256	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	103
PID 644 wrote to memory of 4256	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	103
PID 644 wrote to memory of 4256	644	dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe	103

C:\Users\Admin\AppData\Local\Temp\dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe
"C:\Users\Admin\AppData\Local\Temp\dbf61c74b417371377d4011fa09211cde9c1033081ce30b2f20948f7ebc032a1.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:644
- C:\Windows\SysWOW64\GameBarPresenceWriter.exe
  C:\Windows\SysWOW64\GameBarPresenceWriter.exe
  2⤵
  PID:8
- C:\Windows\SysWOW64\InfDefaultInstall.exe
  C:\Windows\SysWOW64\InfDefaultInstall.exe
  2⤵
  PID:4992
- C:\Windows\SysWOW64\RdpSa.exe
  C:\Windows\SysWOW64\RdpSa.exe
  2⤵
  PID:4068
- C:\Windows\SysWOW64\RMActivate_ssp.exe
  C:\Windows\SysWOW64\RMActivate_ssp.exe
  2⤵
  PID:3872
- C:\Windows\SysWOW64\LaunchTM.exe
  C:\Windows\SysWOW64\LaunchTM.exe
  2⤵
  PID:4168
- C:\Windows\SysWOW64\PkgMgr.exe
  C:\Windows\SysWOW64\PkgMgr.exe
  2⤵
  PID:3788
- C:\Windows\SysWOW64\ReAgentc.exe
  C:\Windows\SysWOW64\ReAgentc.exe
  2⤵
  PID:3104
- C:\Windows\SysWOW64\comp.exe
  C:\Windows\SysWOW64\comp.exe
  2⤵
  PID:4740
- C:\Windows\SysWOW64\MRINFO.EXE
  C:\Windows\SysWOW64\MRINFO.EXE
  2⤵
  PID:4408
- C:\Windows\SysWOW64\RpcPing.exe
  C:\Windows\SysWOW64\RpcPing.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1916
- C:\Windows\SysWOW64\regedit.exe
  C:\Windows\SysWOW64\regedit.exe
  2⤵
  - Runs regedit.exe
  PID:2524
- C:\Windows\SysWOW64\hh.exe
  C:\Windows\SysWOW64\hh.exe
  2⤵
  PID:1960
- C:\Windows\SysWOW64\eudcedit.exe
  C:\Windows\SysWOW64\eudcedit.exe
  2⤵
  PID:2108
- C:\Windows\SysWOW64\proquota.exe
  C:\Windows\SysWOW64\proquota.exe
  2⤵
  PID:1932
- C:\Windows\SysWOW64\tar.exe
  C:\Windows\SysWOW64\tar.exe
  2⤵
  PID:2020
- C:\Windows\SysWOW64\iscsicli.exe
  C:\Windows\SysWOW64\iscsicli.exe
  2⤵
  PID:2444
- C:\Windows\SysWOW64\runas.exe
  C:\Windows\SysWOW64\runas.exe
  2⤵
  - Access Token Manipulation: Create Process with Token
  PID:1992
- C:\Windows\SysWOW64\MuiUnattend.exe
  C:\Windows\SysWOW64\MuiUnattend.exe
  2⤵
  PID:1244
- C:\Windows\SysWOW64\RMActivate_isv.exe
  C:\Windows\SysWOW64\RMActivate_isv.exe
  2⤵
  PID:4668
- C:\Windows\SysWOW64\SystemPropertiesHardware.exe
  C:\Windows\SysWOW64\SystemPropertiesHardware.exe
  2⤵
  PID:1692
- C:\Windows\SysWOW64\SystemUWPLauncher.exe
  C:\Windows\SysWOW64\SystemUWPLauncher.exe
  2⤵
  PID:5100
- C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe
  C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe
  2⤵
  PID:2808
- C:\Windows\SysWOW64\EhStorAuthn.exe
  C:\Windows\SysWOW64\EhStorAuthn.exe
  2⤵
  PID:1784
- C:\Windows\SysWOW64\secinit.exe
  C:\Windows\SysWOW64\secinit.exe
  2⤵
  PID:4832
- C:\Windows\SysWOW64\diskusage.exe
  C:\Windows\SysWOW64\diskusage.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

royuM.log

Path C:\Users\Admin\AppData\Local\Temp\royuM.log
Size 9.6MB
SHA256 64a57eab4d479036b2730d2e5d3786eea940cbee38c7502c50ba0b761168bdfc
MD5 f4b4b99c381a002925f95c13d368ff0e
SHA1 ef8cbe9a9c26584ac4f6a2223cd04ecaf8dce884
SHA512 d3e2555e346a6846604050a334b2e9a77768a7e0ec7b4d6a9b73394dad21c270e28f8e14a62bd9073cfee2f8ab254bd64c6da6a8df010b9f5390a5ce76d566de
SSDEEP 196608:CbcOli2XykeihBWeFXy+IFTYMjcAfx3yJ+KGxr2cDuf:CQ9NHcBWeFXOlRjrQJglrqf
TLSH
T1EEA6F133F18270B5D0E42030616A7BBB763872164B0D99FBD397AEFC2A351D0666B356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loldsb.ini

Path C:\loldsb.ini
Size 162B
SHA256 355b078ccdcfe7e4a503aba64b50bbef930b2d4c0b6d6acf4fbc41facda37e26
MD5 200f61bc78c5aa72db99d5d890fd28a5
SHA1 9904770ff4d233ad8aa489625199a7837d1529d7
SHA512 0ed6e970126431f9cc1819e1d4504de4f91f928a98f196637fd8c251bcfe9da66f5fac02f7c7bd7b7f464eef3e755951800b9c5a3ed9b2c1dd741bba7c8f0225
TLSH
T15FC08C6083CACE5E4A0CA91BA6BC51CC85E00A0C3EA2332CCE35888C0391D5EBBD5341
MD5 SHA1 SHA512 TLSH

Submit Download

memory/644-69-0x0000000004610000-0x0000000004E74000-memory.dmp

Download

memory/644-3-0x0000000010000000-0x00000000101BC000-memory.dmp

Download

memory/644-14-0x0000000003920000-0x0000000004184000-memory.dmp

Download

memory/644-13-0x0000000003920000-0x0000000004184000-memory.dmp

Download

memory/644-16-0x0000000004610000-0x0000000004E74000-memory.dmp

Download

memory/644-25-0x0000000004610000-0x0000000004E74000-memory.dmp

Download

memory/644-24-0x0000000003190000-0x00000000031B7000-memory.dmp

Download

memory/644-20-0x0000000004610000-0x0000000004E74000-memory.dmp

Download

memory/644-26-0x0000000004610000-0x0000000004E74000-memory.dmp

Download

memory/644-29-0x0000000003190000-0x00000000031B7000-memory.dmp

Download

memory/644-12-0x0000000002DC0000-0x0000000002DE7000-memory.dmp

Download

memory/644-4-0x0000000003920000-0x0000000004184000-memory.dmp

Download

memory/644-64-0x0000000002DC0000-0x0000000002DE7000-memory.dmp

Download

memory/644-70-0x0000000003190000-0x00000000031B7000-memory.dmp

Download

memory/644-15-0x0000000002DC0000-0x0000000002DE7000-memory.dmp

Download

memory/644-63-0x0000000003920000-0x0000000004184000-memory.dmp

Download

memory/4256-84-0x0000000003270000-0x0000000003297000-memory.dmp

Download

memory/4256-65-0x0000000010000000-0x00000000101BC000-memory.dmp

Download

memory/4256-57-0x0000000000400000-0x0000000000DCF000-memory.dmp

Download

memory/4256-58-0x0000000000400000-0x0000000000DCF000-memory.dmp

Download

memory/4256-62-0x0000000000400000-0x0000000000DCF000-memory.dmp

Download

memory/4256-77-0x0000000003210000-0x0000000003237000-memory.dmp

Download

memory/4256-59-0x0000000000400000-0x0000000000DCF000-memory.dmp

Download

memory/4256-60-0x0000000000400000-0x0000000000DCF000-memory.dmp

Download

memory/4256-73-0x0000000003B10000-0x0000000004374000-memory.dmp

Download

memory/4256-78-0x0000000004800000-0x0000000005064000-memory.dmp

Download

memory/4256-80-0x0000000004800000-0x0000000005064000-memory.dmp

Download

memory/4256-71-0x0000000003B10000-0x0000000004374000-memory.dmp

Download

memory/4256-56-0x0000000000400000-0x0000000000DCF000-memory.dmp

Download