Analysis
- user interaction
yes - max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
07/05/2026, 13:18
General
- Target Hisakekop.exe
- Size 8.4MB
- Sample260507-qjxpyaev7x
- SHA256 1f492c7f375e4042a5a2d8c5d02f829bdc5d655f9a1bf39d969355c490525a4d
Malware Config
Signatures
- Clears Windows event logs 1 TTPs 4 IoCs
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 20 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hisakekop.exe"C:\Users\Admin\AppData\Local\Temp\Hisakekop.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" cl System2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" cl Setup2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" cl Security2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" cl Application2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evb3B25.tmp
evb44E7.tmp
evb5EFD.tmp
memory/2500-69-0x0000000029230000-0x000000002924E000-memory.dmp
memory/2500-93-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-7-0x00007FFE78ED0000-0x00007FFE790C5000-memory.dmp
memory/2500-9-0x00007FFE78ED0000-0x00007FFE790C5000-memory.dmp
memory/2500-11-0x00007FFE78ED0000-0x00007FFE790C5000-memory.dmp
memory/2500-10-0x00007FFE78ED0000-0x00007FFE790C5000-memory.dmp
memory/2500-8-0x00007FFE78ED0000-0x00007FFE790C5000-memory.dmp
memory/2500-13-0x00007FFE78ED0000-0x00007FFE790C5000-memory.dmp
memory/2500-14-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-12-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-5-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-6-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-17-0x0000000005AE0000-0x0000000005B02000-memory.dmp
memory/2500-23-0x0000000005B20000-0x0000000005B3A000-memory.dmp
memory/2500-22-0x0000000020D40000-0x0000000020D86000-memory.dmp
memory/2500-24-0x00007FFE78ED0000-0x00007FFE790C5000-memory.dmp
memory/2500-15-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-16-0x00007FFE78ED0000-0x00007FFE790C5000-memory.dmp
memory/2500-25-0x0000000022590000-0x0000000022674000-memory.dmp
memory/2500-3-0x00007FFE78ED0000-0x00007FFE790C5000-memory.dmp
memory/2500-30-0x0000000023770000-0x0000000023820000-memory.dmp
memory/2500-44-0x0000000023740000-0x0000000023760000-memory.dmp
memory/2500-49-0x00000000291B0000-0x00000000291CE000-memory.dmp
memory/2500-39-0x0000000029160000-0x00000000291AA000-memory.dmp
memory/2500-54-0x00000000291D0000-0x00000000291EC000-memory.dmp
memory/2500-59-0x0000000029250000-0x00000000292AA000-memory.dmp
memory/2500-1-0x00007FFE78F6D000-0x00007FFE78F6E000-memory.dmp
memory/2500-2-0x00007FFE78ED0000-0x00007FFE790C5000-memory.dmp
memory/2500-4-0x00007FFE78ED0000-0x00007FFE790C5000-memory.dmp
memory/2500-76-0x0000000005AB0000-0x0000000005ABC000-memory.dmp
memory/2500-64-0x00000000292E0000-0x0000000029306000-memory.dmp
memory/2500-74-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-81-0x0000000022EA0000-0x0000000022EA8000-memory.dmp
memory/2500-84-0x0000000180000000-0x0000000180137000-memory.dmp
memory/2500-92-0x0000000180000000-0x0000000180137000-memory.dmp
memory/2500-91-0x00000000292C0000-0x00000000292CC000-memory.dmp
memory/2500-0-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-75-0x0000000000C00000-0x0000000000C9B000-memory.dmp
memory/2500-94-0x00007FFE78ED0000-0x00007FFE790C5000-memory.dmp
memory/2500-95-0x00007FFE78ED0000-0x00007FFE790C5000-memory.dmp
memory/2500-96-0x00007FFE78ED0000-0x00007FFE790C5000-memory.dmp
memory/2500-97-0x00007FFE78ED0000-0x00007FFE790C5000-memory.dmp
memory/2500-99-0x0000000000C00000-0x0000000000C9B000-memory.dmp
memory/2500-101-0x0000000180000000-0x0000000180137000-memory.dmp
memory/2500-98-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-102-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-106-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-110-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-114-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-118-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-122-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-126-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-130-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-134-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-138-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-142-0x0000000000E90000-0x0000000002456000-memory.dmp
memory/2500-146-0x0000000000E90000-0x0000000002456000-memory.dmp