Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
22/04/2026, 12:29
General
- Target filezilla.exe
- Size 4.1MB
- Sample260422-ppb5rabw3x
- SHA256 c3a470356eb16dbfb1ab3e89588c890fcde618b9abdb3416a5441596c08eb931
Malware Config
Signatures
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 1 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\filezilla.exe"C:\Users\Admin\AppData\Local\Temp\filezilla.exe"1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4832-0-0x00007FF6B24A0000-0x00007FF6B28C5000-memory.dmp
memory/4832-39-0x00007FFD43720000-0x00007FFD437EA000-memory.dmp
memory/4832-43-0x00007FFD3A890000-0x00007FFD3A934000-memory.dmp
memory/4832-54-0x0000017C27370000-0x0000017C27446000-memory.dmp
memory/4832-53-0x00007FFD43860000-0x00007FFD4389E000-memory.dmp
memory/4832-52-0x0000000061F00000-0x0000000061F29000-memory.dmp
memory/4832-51-0x00007FFD45430000-0x00007FFD45477000-memory.dmp
memory/4832-50-0x00007FFD46ED0000-0x00007FFD46F10000-memory.dmp
memory/4832-49-0x00007FFD33CE0000-0x00007FFD33EFC000-memory.dmp
memory/4832-48-0x00007FFD43CB0000-0x00007FFD43D06000-memory.dmp
memory/4832-47-0x00007FFD4D970000-0x00007FFD4D982000-memory.dmp
memory/4832-46-0x00007FFD33F00000-0x00007FFD34131000-memory.dmp
memory/4832-45-0x00007FFD45730000-0x00007FFD45779000-memory.dmp
memory/4832-42-0x00007FFD4A510000-0x00007FFD4A53B000-memory.dmp
memory/4832-41-0x00007FFD4D9C0000-0x00007FFD4D9D2000-memory.dmp
memory/4832-40-0x0000000066380000-0x00000000664BB000-memory.dmp
memory/4832-37-0x00007FFD38820000-0x00007FFD389F0000-memory.dmp
memory/4832-38-0x00007FFD43D10000-0x00007FFD43D95000-memory.dmp
memory/4832-36-0x00007FFD438A0000-0x00007FFD43A15000-memory.dmp
memory/4832-44-0x00007FFD34140000-0x00007FFD34650000-memory.dmp
memory/4832-35-0x00007FFD43DA0000-0x00007FFD43EA5000-memory.dmp
memory/4832-34-0x00007FFD44460000-0x00007FFD444DE000-memory.dmp
memory/4832-33-0x00007FFD43EB0000-0x00007FFD43F58000-memory.dmp
memory/4832-32-0x00007FF6B24A0000-0x00007FF6B28C5000-memory.dmp
memory/4832-68-0x00007FFD34140000-0x00007FFD34650000-memory.dmp
memory/4832-61-0x00007FFD38820000-0x00007FFD389F0000-memory.dmp
memory/4832-91-0x00007FFD34140000-0x00007FFD34650000-memory.dmp
memory/4832-114-0x00007FFD34140000-0x00007FFD34650000-memory.dmp
memory/4832-137-0x00007FFD34140000-0x00007FFD34650000-memory.dmp
memory/4832-160-0x00007FFD34140000-0x00007FFD34650000-memory.dmp
memory/4832-183-0x00007FFD34140000-0x00007FFD34650000-memory.dmp
memory/4832-229-0x00007FFD34140000-0x00007FFD34650000-memory.dmp
memory/4832-298-0x00007FFD34140000-0x00007FFD34650000-memory.dmp