Overview
overview
9Static
static
3e1c1316f4d...5b.exe
windows10-2004-x64
9e1c1316f4d...5b.exe
windows11-21h2-x64
9$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3LICENSES.c...m.html
windows10-2004-x64
4LICENSES.c...m.html
windows11-21h2-x64
4d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows10-2004-x64
1focizClient.exe
windows10-2004-x64
9libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows10-2004-x64
1resources/elevate.exe
windows10-2004-x64
3resources/elevate.exe
windows11-21h2-x64
3vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows10-2004-x64
3$PLUGINSDI...7z.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/05/2026, 22:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e1c1316f4d9060a9df4e4bef7583300764fe6e8352acd1509a267462722bb75b.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
e1c1316f4d9060a9df4e4bef7583300764fe6e8352acd1509a267462722bb75b.exe
Resource
win11-20260513-en
windows11-21h2-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral9
Sample
d3dcompiler_47.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
ffmpeg.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
focizClient.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral12
Sample
libEGL.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
libGLESv2.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
resources/elevate.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
resources/elevate.exe
Resource
win11-20260513-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
vk_swiftshader.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
vulkan-1.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win11-20260513-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target focizClient.exe
- Size 180.0MB
- Sample260517-2pjk2sdv71
- SHA256 832c9b2dd15ba5a611f70d79024fa3607b893a228b30650034e712ff1d534be8
- MD5 cc7e78b08b7fca4951603b29095e9ae8
- SHA1 07c3f41d4a46a1272b86109152da95ec6b39a8f1
- SHA512 e36f96592f4c9423924ae8b963c3f77c54967c2b275f4a83e43531226071cc69081302efd98d11adb1a8d6c2a9a31871852dffdfe7ad66ecbd154879f362a02c
- SSDEEP 1572864:IH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:9sok+hK7
- TLSH T1DF988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ c0958748f41af368.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c0958748f41af368.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion c0958748f41af368.exe - Executes dropped EXE 1 IoCs
pid Process 988 c0958748f41af368.exe -
resource yara_rule behavioral11/files/0x0008000000024450-31.dat themida behavioral11/memory/988-36-0x0000000140000000-0x00000001407A5000-memory.dmp themida behavioral11/memory/988-35-0x0000000140000000-0x00000001407A5000-memory.dmp themida behavioral11/memory/988-37-0x0000000140000000-0x00000001407A5000-memory.dmp themida behavioral11/memory/988-38-0x0000000140000000-0x00000001407A5000-memory.dmp themida - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c0958748f41af368.exe - Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz focizClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString focizClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz focizClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz focizClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString focizClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 focizClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 focizClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz focizClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString focizClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz focizClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 focizClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz focizClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 focizClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 focizClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz focizClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString focizClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString focizClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz focizClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 focizClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString focizClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString focizClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 focizClient.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString focizClient.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 focizClient.exe - Kills process with taskkill 1 IoCs
pid Process 4420 taskkill.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1588 powershell.exe 1588 powershell.exe 3768 powershell.exe 3768 powershell.exe 988 c0958748f41af368.exe 988 c0958748f41af368.exe - Suspicious use of AdjustPrivilegeToken 38 IoCs
description pid Process Token: SeDebugPrivilege 1588 powershell.exe Token: SeIncreaseQuotaPrivilege 1588 powershell.exe Token: SeSecurityPrivilege 1588 powershell.exe Token: SeTakeOwnershipPrivilege 1588 powershell.exe Token: SeLoadDriverPrivilege 1588 powershell.exe Token: SeSystemProfilePrivilege 1588 powershell.exe Token: SeSystemtimePrivilege 1588 powershell.exe Token: SeProfSingleProcessPrivilege 1588 powershell.exe Token: SeIncBasePriorityPrivilege 1588 powershell.exe Token: SeCreatePagefilePrivilege 1588 powershell.exe Token: SeBackupPrivilege 1588 powershell.exe Token: SeRestorePrivilege 1588 powershell.exe Token: SeShutdownPrivilege 1588 powershell.exe Token: SeDebugPrivilege 1588 powershell.exe Token: SeSystemEnvironmentPrivilege 1588 powershell.exe Token: SeRemoteShutdownPrivilege 1588 powershell.exe Token: SeUndockPrivilege 1588 powershell.exe Token: SeManageVolumePrivilege 1588 powershell.exe Token: 33 1588 powershell.exe Token: 34 1588 powershell.exe Token: 35 1588 powershell.exe Token: 36 1588 powershell.exe Token: SeShutdownPrivilege 1992 focizClient.exe Token: SeCreatePagefilePrivilege 1992 focizClient.exe Token: SeDebugPrivilege 4420 taskkill.exe Token: SeDebugPrivilege 3768 powershell.exe Token: SeShutdownPrivilege 1992 focizClient.exe Token: SeCreatePagefilePrivilege 1992 focizClient.exe Token: SeShutdownPrivilege 1992 focizClient.exe Token: SeCreatePagefilePrivilege 1992 focizClient.exe Token: SeShutdownPrivilege 1992 focizClient.exe Token: SeCreatePagefilePrivilege 1992 focizClient.exe Token: SeShutdownPrivilege 1992 focizClient.exe Token: SeCreatePagefilePrivilege 1992 focizClient.exe Token: SeShutdownPrivilege 1992 focizClient.exe Token: SeCreatePagefilePrivilege 1992 focizClient.exe Token: SeShutdownPrivilege 1992 focizClient.exe Token: SeCreatePagefilePrivilege 1992 focizClient.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1992 wrote to memory of 4520 1992 focizClient.exe 82 PID 1992 wrote to memory of 4520 1992 focizClient.exe 82 PID 1992 wrote to memory of 4000 1992 focizClient.exe 83 PID 4000 wrote to memory of 1588 4000 cmd.exe 85 PID 1992 wrote to memory of 4644 1992 focizClient.exe 87 PID 4644 wrote to memory of 2192 4644 cmd.exe 89 PID 2192 wrote to memory of 2684 2192 net.exe 90 PID 1992 wrote to memory of 1796 1992 focizClient.exe 91 PID 1796 wrote to memory of 4420 1796 cmd.exe 93 PID 1992 wrote to memory of 3768 1992 focizClient.exe 94 PID 1992 wrote to memory of 2528 1992 focizClient.exe 96 PID 1992 wrote to memory of 988 1992 focizClient.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\focizClient.exe"C:\Users\Admin\AppData\Local\Temp\focizClient.exe"1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\focizClient.exe"C:\Users\Admin\AppData\Local\Temp\focizClient.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\focizclient-c1i9" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1760,i,17288218620591695023,14116266504021738743,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:22⤵PID:4520
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA=="2⤵
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -NonInteractive -EncodedCommand RwBlAHQALQBDAGkAbQBJAG4AcwB0AGEAbgBjAGUAIABXAGkAbgAzADIAXwBWAGkAZABlAG8AQwBvAG4AdAByAG8AbABsAGUAcgAgAHwAIABTAGUAbABlAGMAdAAtAE8AYgBqAGUAYwB0ACAALQBFAHgAcABhAG4AZABQAHIAbwBwAGUAcgB0AHkAIABOAGEAbQBlAA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1588
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net session"2⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\system32\net.exenet session3⤵
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session4⤵PID:2684
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM SecHealthUI.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\system32\taskkill.exetaskkill /F /IM SecHealthUI.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4420
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -EncodedCommand dAByAHkAIAB7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAJwAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAgAH0AIABjAGEAdABjAGgAIAB7AH0A2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-
C:\Users\Admin\AppData\Local\Temp\focizClient.exe"C:\Users\Admin\AppData\Local\Temp\focizClient.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\focizclient-c1i9" --field-trial-handle=1992,i,17288218620591695023,14116266504021738743,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:32⤵PID:2528
-
-
C:\Users\Admin\AppData\Local\Temp\c0958748f41af368.exeC:\Users\Admin\AppData\Local\Temp\c0958748f41af368.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:988
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 3KB
- SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
- MD5 3bfc414667e1ebc31e9259fa1db290fa
- SHA1 9bff989429779efef334e5524a362e7b6ff266cb
- SHA512 e6cb000e8f900132f7dc661f943b8e91e945d171157ff3289b91e9d79f70230e363ed65b7ec97f451b376cf4706a14de9a86193e72dcea8fe3aa8c86c6117d13
- TLSH T1E371BF323375B0D4C9567F072A2819C063BF4396EA98AF4CB25C621ED92751B9B122F7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 7efad5d80ceddcb6a8e1440b20b24873c49cb003daa8fe26bb155e2ff7f67a36
- MD5 254d1077b0d593ece03889bca07acea3
- SHA1 bae1e32158aa755aa2fb447fdbd434c792fdeacf
- SHA512 475693dc92e9b2484f8e00e1d659b428e150bf8b7f16105e19dc857dfd1b19bf62da9dfe5f6a34d3623fc4db9b1a548eef44b68118281e5546c1d70f898cd655
- TLSH T1E4218727B39DC861CC99153A209CAC5172B683C7809ECF8F6FC0D225A07FAC4CB71594
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v2ttken5.suh.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\c0958748f41af368.exe
- Size 3.2MB
- SHA256 b4995ef9734c892b27a817feed33c186f89369665777dde830ffe79c58e1e369
- MD5 d37348b7448fab48730ac7c85b25fc9a
- SHA1 a7db86a589feb77ab10aac54b133c58b8a944510
- SHA512 03f2d0af59fe6b63be26e58bd4117f765691da041d3f07b208566dad4e7412889bd6d17f04bf54283c46b84abeffe79d0781f2cdcaca1bbc96fdbcf6623277b5
- SSDEEP 49152:A76AgKZOXb2HyHTAe32eHruIdKklmx+AIJF+5iu7jR6ApYjUQFNIEPcnijiA663:ADc6SH72orugKLI/qi8jVeHKviR66CO
- TLSH T1FFF533C35E8569BAC08A17BBDD29F0C1292E9C70DEE74755209D8AFF3256100DD7BAC8
- MD5 SHA1 SHA512 SSDEEP TLSH