Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
08/05/2026, 10:20
General
- Target 658232257a118d40cf8cece808e7983138fd8e0ebb7388b3a54580bb471f785d.exe
- Size 3.8MB
- Sample260508-mdltpsay8n
- SHA256 658232257a118d40cf8cece808e7983138fd8e0ebb7388b3a54580bb471f785d
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Drops file in Drivers directory 1 IoCs
- Executes dropped EXE 2 IoCs
- Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- VMProtect packed file 11 IoCs
Detects executables packed with VMProtect commercial packer.
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\658232257a118d40cf8cece808e7983138fd8e0ebb7388b3a54580bb471f785d.exe"C:\Users\Admin\AppData\Local\Temp\658232257a118d40cf8cece808e7983138fd8e0ebb7388b3a54580bb471f785d.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\driverquery.exe"C:\Windows\system32\driverquery.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\658232257a118d40cf8cece808e7983138fd8e0ebb7388b3a54580bb471f785d.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\Help\iscsicpl.exe"C:\Windows\Help\iscsicpl.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\fontview.exe"C:\fontview.exe"2⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
iscsicpl.exe
fontview.exe
memory/1308-51-0x000002322E050000-0x000002322E2F6000-memory.dmp
memory/1308-77-0x000002322C840000-0x000002322C841000-memory.dmp
memory/1308-48-0x000002322C4F0000-0x000002322C4F3000-memory.dmp
memory/1308-52-0x000002322E050000-0x000002322E2F6000-memory.dmp
memory/1308-59-0x000002322C840000-0x000002322C841000-memory.dmp
memory/1308-76-0x000002322E050000-0x000002322E2F6000-memory.dmp
memory/1528-24-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/1528-80-0x00000000010A0000-0x000000000115B000-memory.dmp
memory/1528-5-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/1528-6-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/1528-11-0x00000000001D0000-0x00000000002C8000-memory.dmp
memory/1528-2-0x00000000001D0000-0x00000000002C8000-memory.dmp
memory/1528-86-0x00000000010A0000-0x000000000115B000-memory.dmp
memory/1528-39-0x0000000000D70000-0x0000000000D77000-memory.dmp
memory/1528-87-0x0000000000D70000-0x0000000000D77000-memory.dmp
memory/1528-88-0x00000000001D0000-0x00000000002C8000-memory.dmp
memory/1528-0-0x00000000001D0000-0x00000000002C8000-memory.dmp
memory/1528-38-0x00000000010A0000-0x000000000115B000-memory.dmp
memory/2420-42-0x0000021DCCA80000-0x0000021DCCCFC000-memory.dmp
memory/2420-35-0x0000021DCCA80000-0x0000021DCCCFC000-memory.dmp
memory/2420-107-0x0000021DCD800000-0x0000021DCD965000-memory.dmp
memory/2420-102-0x0000021DCD800000-0x0000021DCD965000-memory.dmp
memory/2420-36-0x00007FF924DF0000-0x00007FF924E00000-memory.dmp
memory/2420-37-0x0000021DCC950000-0x0000021DCC951000-memory.dmp
memory/2420-27-0x0000021DCCA80000-0x0000021DCCCFC000-memory.dmp
memory/2420-28-0x0000021DCCA80000-0x0000021DCCCFC000-memory.dmp
memory/2420-25-0x0000021DCCA80000-0x0000021DCCCFC000-memory.dmp
memory/2420-100-0x0000021DCD800000-0x0000021DCD965000-memory.dmp
memory/2420-93-0x00007FF924DF0000-0x00007FF924E00000-memory.dmp
memory/2512-66-0x0000022742520000-0x000002274279C000-memory.dmp
memory/2512-72-0x0000022742520000-0x000002274279C000-memory.dmp
memory/2512-73-0x00007FF924DF0000-0x00007FF924E00000-memory.dmp
memory/2512-63-0x0000022742520000-0x000002274279C000-memory.dmp
memory/3104-19-0x0000000002850000-0x0000000002851000-memory.dmp
memory/3104-18-0x0000000002830000-0x0000000002833000-memory.dmp
memory/3104-12-0x0000000004F90000-0x0000000005236000-memory.dmp
memory/3104-8-0x0000000002830000-0x0000000002833000-memory.dmp
memory/3104-7-0x0000000002830000-0x0000000002833000-memory.dmp
memory/3104-14-0x0000000004F90000-0x0000000005236000-memory.dmp
memory/3104-97-0x0000000003D50000-0x0000000003D51000-memory.dmp
memory/3104-95-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/3104-96-0x0000000002DF0000-0x0000000002DF1000-memory.dmp
memory/3104-9-0x0000000004F90000-0x0000000005236000-memory.dmp
memory/3104-41-0x0000000002850000-0x0000000002851000-memory.dmp
memory/3104-40-0x0000000004F90000-0x0000000005236000-memory.dmp
memory/5880-94-0x00000000011E0000-0x000000000129B000-memory.dmp