Resubmissions
28/04/2026, 01:52
260428-calpescv51828/04/2026, 01:41
260428-b35gkafw3p328/04/2026, 01:37
260428-b2cedsct211028/04/2026, 01:32
260428-byf86sfv5r1028/04/2026, 01:28
260428-bvvbmafv3m1028/04/2026, 01:22
260428-bra4ksb19x1028/04/2026, 01:12
260428-bkwrpsft2l10Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
28/04/2026, 01:52
General
- Target gi9trtiw0n0whtld.exe
- Size 671KB
- Sample260428-calpescv51
- SHA256 14d9c2d2a3846eaf856f7dc378df8a587f10f2702c36e00b90e92e5ac570e17f
Malware Config
Signatures
- Disables Task Manager via registry modification
- Drops startup file 2 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Start PowerShell.
- Drops file in System32 directory 1 IoCs
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\gi9trtiw0n0whtld.exe"C:\Users\Admin\AppData\Local\Temp\gi9trtiw0n0whtld.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp720E.tmp.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp720E.tmp.exe"'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmp720E.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp720E.tmp.exe"4⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\tmp720E.tmp.exeC:\Users\Admin\AppData\Local\Temp\tmp720E.tmp.exe1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_ofzlugnk.ybt.ps1
obesity_music.mp3
tmp720E.tmp.exe
wallpaper_temp.bmp
ObesityLocker.bat
t.me_euxaodev_240678578_4.txt
memory/1040-33-0x0000024CC8170000-0x0000024CC817C000-memory.dmp
memory/1040-32-0x0000024CC7F00000-0x0000024CC80AC000-memory.dmp
memory/1040-34-0x0000024CC9A50000-0x0000024CC9A62000-memory.dmp
memory/1040-21-0x0000024CC9C70000-0x0000024CC9C92000-memory.dmp
memory/1040-19-0x0000024CC9AA0000-0x0000024CC9AB0000-memory.dmp
memory/1040-20-0x0000024CC9AA0000-0x0000024CC9AB0000-memory.dmp
memory/2280-13-0x000001B64A250000-0x000001B64A25C000-memory.dmp
memory/2280-5-0x000001B6643B0000-0x000001B6643C0000-memory.dmp
memory/2280-10-0x000001B6642E0000-0x000001B6643AA000-memory.dmp
memory/2280-9-0x000001B6643B0000-0x000001B6643C0000-memory.dmp
memory/2280-8-0x000001B6643B0000-0x000001B6643C0000-memory.dmp
memory/2280-7-0x000001B64A130000-0x000001B64A142000-memory.dmp
memory/2280-6-0x000001B64A120000-0x000001B64A12C000-memory.dmp
memory/2280-0-0x000001B649BE0000-0x000001B649C8C000-memory.dmp
memory/2280-1-0x000001B6643B0000-0x000001B6643C0000-memory.dmp
memory/2280-4-0x000001B6643B0000-0x000001B6643C0000-memory.dmp
memory/3172-48-0x000001FFE83B0000-0x000001FFE83C0000-memory.dmp
memory/3172-2821-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/3172-50-0x000001FFE83B0000-0x000001FFE83C0000-memory.dmp
memory/3172-51-0x000001FFE83B0000-0x000001FFE83C0000-memory.dmp
memory/3172-49-0x000001FFE83B0000-0x000001FFE83C0000-memory.dmp
memory/3172-3985-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/3172-841-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/3172-3577-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/3172-3169-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/3172-53-0x000001FFE83B0000-0x000001FFE83C0000-memory.dmp
memory/3172-425-0x000001FFE3250000-0x000001FFE325C000-memory.dmp
memory/3172-424-0x000001FFE2FB0000-0x000001FFE315C000-memory.dmp
memory/3172-423-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/3172-2413-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/3172-2005-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/3172-1607-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/3172-1209-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/4816-95-0x0000027D73910000-0x0000027D73920000-memory.dmp
memory/4816-844-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/4816-1252-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/4816-466-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/4816-1650-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/4816-467-0x0000027D6E550000-0x0000027D6E6FC000-memory.dmp
memory/4816-2048-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/4816-468-0x0000027D701B0000-0x0000027D701BC000-memory.dmp
memory/4816-2456-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/4816-96-0x0000027D73910000-0x0000027D73920000-memory.dmp
memory/4816-2864-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/4816-93-0x0000027D73910000-0x0000027D73920000-memory.dmp
memory/4816-3212-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/4816-94-0x0000027D73910000-0x0000027D73920000-memory.dmp
memory/4816-3620-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp
memory/4816-82-0x0000027D73910000-0x0000027D73920000-memory.dmp
memory/4816-4028-0x00007FF6B3080000-0x00007FF6B35CF000-memory.dmp