Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
22/04/2026, 12:29
General
- Target filezilla.exe
- Size 4.1MB
- Sample260422-ppb5rabw3x
- SHA256 c3a470356eb16dbfb1ab3e89588c890fcde618b9abdb3416a5441596c08eb931
Malware Config
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\filezilla.exe"C:\Users\Admin\AppData\Local\Temp\filezilla.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2528-0-0x00007FF6CF5B0000-0x00007FF6CF9D5000-memory.dmp
memory/2528-34-0x00007FFFAFCC0000-0x00007FFFAFDC5000-memory.dmp
memory/2528-42-0x00007FFFA33A0000-0x00007FFFA35D1000-memory.dmp
memory/2528-45-0x00007FFFA2DE0000-0x00007FFFA32F0000-memory.dmp
memory/2528-53-0x00007FFFA4090000-0x00007FFFA40CE000-memory.dmp
memory/2528-52-0x00007FFFA2BC0000-0x00007FFFA2DDC000-memory.dmp
memory/2528-51-0x00007FFFAFEB0000-0x00007FFFAFEF0000-memory.dmp
memory/2528-50-0x0000000068BB0000-0x0000000068BD9000-memory.dmp
memory/2528-49-0x00007FFFAFBC0000-0x00007FFFAFC07000-memory.dmp
memory/2528-48-0x00007FFFB6870000-0x00007FFFB6882000-memory.dmp
memory/2528-47-0x00007FFFAFC60000-0x00007FFFAFCB6000-memory.dmp
memory/2528-46-0x00007FFFAFEF0000-0x00007FFFAFF39000-memory.dmp
memory/2528-44-0x00007FFFB9260000-0x00007FFFB9272000-memory.dmp
memory/2528-43-0x00007FFFA32F0000-0x00007FFFA3394000-memory.dmp
memory/2528-41-0x0000000066380000-0x00000000664BB000-memory.dmp
memory/2528-40-0x00007FFFAFF40000-0x00007FFFAFF6B000-memory.dmp
memory/2528-39-0x00007FFFA35E0000-0x00007FFFA36AA000-memory.dmp
memory/2528-38-0x00007FFFAFFC0000-0x00007FFFB0045000-memory.dmp
memory/2528-37-0x00007FFFA36B0000-0x00007FFFA3880000-memory.dmp
memory/2528-36-0x00007FFFAF9D0000-0x00007FFFAFB45000-memory.dmp
memory/2528-35-0x00007FFFB0300000-0x00007FFFB03A8000-memory.dmp
memory/2528-33-0x00007FFFB0460000-0x00007FFFB04DE000-memory.dmp
memory/2528-32-0x00007FF6CF5B0000-0x00007FF6CF9D5000-memory.dmp
memory/2528-54-0x000001AE02130000-0x000001AE0286F000-memory.dmp
memory/2528-69-0x00007FFFA2DE0000-0x00007FFFA32F0000-memory.dmp
memory/2528-61-0x00007FFFA36B0000-0x00007FFFA3880000-memory.dmp
memory/2528-92-0x00007FFFA2DE0000-0x00007FFFA32F0000-memory.dmp
memory/2528-115-0x00007FFFA2DE0000-0x00007FFFA32F0000-memory.dmp
memory/2528-161-0x00007FFFA2DE0000-0x00007FFFA32F0000-memory.dmp
memory/2528-184-0x00007FFFA2DE0000-0x00007FFFA32F0000-memory.dmp
memory/2528-276-0x00007FFFA2DE0000-0x00007FFFA32F0000-memory.dmp
memory/2528-299-0x00007FFFA2DE0000-0x00007FFFA32F0000-memory.dmp
memory/2528-322-0x00007FFFA2DE0000-0x00007FFFA32F0000-memory.dmp