Analysis
- user interaction
yes - max time kernel
900s - max time network
904s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
29/04/2026, 10:01
General
- Target seafile-applet.exe
- Size 6.4MB
- Sample260429-l2d84aev3k
- SHA256 75a3dea324bc49142f2780124ae6862af76de19e847c2e81894718e43fa08715
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of FindShellTrayWindow 15 IoCs
- Suspicious use of SendNotifyMessage 12 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\seafile-applet.exe"C:\Users\Admin\AppData\Local\Temp\seafile-applet.exe"1⤵
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\seafile-applet.exeseafile-applet.exe2⤵
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\seafile-applet.exeC:\Users\Admin\AppData\Local\Temp\seafile-applet.exe1⤵
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
uip.bin
uip.bin
memory/1444-0-0x00007FF842C70000-0x00007FF843231000-memory.dmp
memory/1444-1-0x00007FF841F80000-0x00007FF842473000-memory.dmp
memory/1444-2-0x00007FF6BA260000-0x00007FF6BA8D2000-memory.dmp
memory/1444-3-0x000001C58E950000-0x000001C58E960000-memory.dmp
memory/1444-4-0x000001C58CEF0000-0x000001C58CF8B000-memory.dmp
memory/1444-9-0x000001C58EAD0000-0x000001C58F24B000-memory.dmp
memory/1444-15-0x000001C592500000-0x000001C592F3C000-memory.dmp
memory/1444-21-0x000001C58CEF0000-0x000001C58CF8B000-memory.dmp
memory/4604-31-0x00000229571A0000-0x000002295723B000-memory.dmp
memory/4604-24-0x00007FF841F80000-0x00007FF842473000-memory.dmp
memory/4604-30-0x00007FF8410E0000-0x00007FF84112A000-memory.dmp
memory/4604-29-0x00007FF841130000-0x00007FF84138D000-memory.dmp
memory/4604-25-0x00007FF8235F0000-0x00007FF8245F0000-memory.dmp
memory/4604-28-0x00007FF849E80000-0x00007FF849EAB000-memory.dmp
memory/4604-27-0x00007FF8503D0000-0x00007FF8503ED000-memory.dmp
memory/4604-57-0x00000229592E0000-0x0000022959A5B000-memory.dmp
memory/4604-67-0x000002295C9A0000-0x000002295D6C0000-memory.dmp
memory/4604-22-0x00007FF6BA260000-0x00007FF6BA8D2000-memory.dmp
memory/4604-23-0x00007FF842C70000-0x00007FF843231000-memory.dmp
memory/4848-115-0x00007FF6BA260000-0x00007FF6BA8D2000-memory.dmp
memory/4848-125-0x00007FF8503D0000-0x00007FF8503ED000-memory.dmp
memory/4848-126-0x00007FF849E80000-0x00007FF849EAB000-memory.dmp
memory/4848-128-0x00007FF840770000-0x00007FF840790000-memory.dmp
memory/4848-127-0x0000013D70240000-0x0000013D702DB000-memory.dmp
memory/4848-171-0x0000013D72160000-0x0000013D728DB000-memory.dmp
memory/4848-182-0x0000013D75A30000-0x0000013D76872000-memory.dmp
memory/4848-116-0x00007FF842C70000-0x00007FF843231000-memory.dmp
memory/4848-117-0x00007FF841F80000-0x00007FF842473000-memory.dmp