Analysis
- max time kernel
10s - max time network
8s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
31/05/2026, 21:42
General
- Target LiberlyCrypt.exe
- Size 31KB
- Sample260531-1kmapsbt2r
- SHA256 f735ee6be521469f84d8bfd90d82a5b9e079d3d09e794eaffe6f386619f47570
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Renames multiple (2837) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
- Drops startup file 2 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Windows directory 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\LiberlyCrypt.exe"C:\Users\Admin\AppData\Local\Temp\LiberlyCrypt.exe"1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Drops startup file
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /tn "SystemSyncService" /tr "C:\Users\Admin\AppData\Local\Temp\LiberlyCrypt.exe" /rl highest2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc minute /mo 30 /tn "SystemCheck" /tr "C:\Users\Admin\AppData\Local\Temp\LiberlyCrypt.exe"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} recoveryenabled No2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c wmic shadowcopy delete2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c netsh interface set interface name="Ethernet" admin=disabled2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh interface set interface name="Ethernet" admin=disabled3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c netsh interface set interface name="Wi-Fi" admin=disabled2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh interface set interface name="Wi-Fi" admin=disabled3⤵
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
dotnet-hostfxr-6.0.27-win-x64.msi.lbr
vc_runtimeAdditional_x86.msi.lbr
CURRENT.lbr
MANIFEST-000001.lbr
index.lbr
data_0.lbr
data_1.lbr
data_2.lbr
data_3.lbr
edbres00002.jrs.lbr
settings.dat.lbr
wctECC1.tmp.lbr
winlogon.exe
1451318868ntouromlalnodry--epcr.sqlite-shm.lbr
3561288849sdhlie.sqlite.lbr
memory/1916-1197-0x000001FCFFE70000-0x000001FCFFE82000-memory.dmp
memory/1916-1200-0x000001FCFFE50000-0x000001FCFFE5A000-memory.dmp
memory/1916-250-0x000001FCFFEB0000-0x000001FCFFEC0000-memory.dmp
memory/1916-0-0x000001FCFEBA0000-0x000001FCFEBAE000-memory.dmp
memory/1916-2104-0x000001FCFFEB0000-0x000001FCFFEC0000-memory.dmp
memory/1916-9-0x000001FCFFEB0000-0x000001FCFFEC0000-memory.dmp
memory/1916-3050-0x000001FCFFEB0000-0x000001FCFFEC0000-memory.dmp