Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
07/05/2026, 13:18
General
- Target Hisakekop.exe
- Size 8.4MB
- Sample260507-qjxpyaev7x
- SHA256 1f492c7f375e4042a5a2d8c5d02f829bdc5d655f9a1bf39d969355c490525a4d
Malware Config
Signatures
- Clears Windows event logs 1 TTPs 4 IoCs
- Loads dropped DLL 1 IoCs
- Obfuscated with Agile.Net obfuscator 20 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Hisakekop.exe"C:\Users\Admin\AppData\Local\Temp\Hisakekop.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" cl System2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" cl Setup2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" cl Security2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\wevtutil.exe"wevtutil.exe" cl Application2⤵
- Clears Windows event logs
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
evb6235.tmp
evb8CAE.tmp
evb8EE7.tmp
memory/4328-51-0x0000000023E70000-0x0000000023E8C000-memory.dmp
memory/4328-28-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-6-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-5-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-7-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-8-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-10-0x0000000005DC0000-0x0000000005DE2000-memory.dmp
memory/4328-15-0x00000000061D0000-0x0000000006216000-memory.dmp
memory/4328-9-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-16-0x0000000005DF0000-0x0000000005E0A000-memory.dmp
memory/4328-17-0x00007FFAE8DE0000-0x00007FFAE8FE9000-memory.dmp
memory/4328-18-0x0000000007500000-0x00000000075E4000-memory.dmp
memory/4328-23-0x0000000023ED0000-0x0000000023F80000-memory.dmp
memory/4328-4-0x00007FFAE8DE0000-0x00007FFAE8FE9000-memory.dmp
memory/4328-29-0x0000000005C70000-0x0000000005C7C000-memory.dmp
memory/4328-61-0x0000000029190000-0x00000000291B6000-memory.dmp
memory/4328-30-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-31-0x00007FFAE8DE0000-0x00007FFAE8FE9000-memory.dmp
memory/4328-36-0x0000000023E20000-0x0000000023E6A000-memory.dmp
memory/4328-41-0x0000000007630000-0x0000000007650000-memory.dmp
memory/4328-46-0x0000000007650000-0x000000000766E000-memory.dmp
memory/4328-0-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-3-0x00007FFAE8DE0000-0x00007FFAE8FE9000-memory.dmp
memory/4328-56-0x0000000029130000-0x000000002918A000-memory.dmp
memory/4328-107-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-66-0x0000000029100000-0x000000002911E000-memory.dmp
memory/4328-75-0x00000000074D0000-0x00000000074D8000-memory.dmp
memory/4328-1-0x00007FFAE8E84000-0x00007FFAE8E85000-memory.dmp
memory/4328-78-0x0000000180000000-0x0000000180137000-memory.dmp
memory/4328-79-0x0000000180000000-0x0000000180137000-memory.dmp
memory/4328-86-0x000000002AB40000-0x000000002AB4C000-memory.dmp
memory/4328-90-0x0000000180000000-0x0000000180137000-memory.dmp
memory/4328-89-0x0000000007350000-0x0000000007362000-memory.dmp
memory/4328-87-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-91-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-95-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-99-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-103-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-2-0x00007FFAE8DE0000-0x00007FFAE8FE9000-memory.dmp
memory/4328-111-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-115-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-119-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-123-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-127-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-131-0x0000000001000000-0x00000000025C6000-memory.dmp
memory/4328-135-0x0000000001000000-0x00000000025C6000-memory.dmp