22a62d38a8c271518b4289ec0f4d79d3fb75887732adf27f0ce2ef966dab9404

Analysis

user interaction
yes
max time kernel
299s
max time network
237s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
04/06/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HeliconFocus.exe
Size 402KB
Sample260604-ebezdaax4k
SHA256 22a62d38a8c271518b4289ec0f4d79d3fb75887732adf27f0ce2ef966dab9404
MD5 a4398dc3ea4a2f59634f33c339df6947
SHA1 5934352bb4004468a2116a21e0b95ae84f9c5f13
SHA512 94249166152145168ce0785afd0a750bf9857abdae0912356e06446eac6ca2021ba03910bb8ccfe31e9c3201648ccd28d46c0689908d66d9a099a365e42c40c5
SSDEEP 12288:sXo/N1AjYNDBPTiKZnqQgL9NzkwmsRIVahfzvhN5dY0ahTLzWAXIBTj8N+Nzi91X:kG1AjYNDBPTiKZnqQgL9NzkwmsRIVahS
TLSH
T11294E6B194069C7EF3628A3542EFC63863EB5FD67A7A004F42857FD661B25D18DE2380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2168-0-0x0000000000400000-0x00000000004E2000-memory.dmp	upx
behavioral1/memory/2168-2-0x0000000000400000-0x00000000004E2000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\HeliconFocus.exe
"C:\Users\Admin\AppData\Local\Temp\HeliconFocus.exe"
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2168-0-0x0000000000400000-0x00000000004E2000-memory.dmp

Download

memory/2168-2-0x0000000000400000-0x00000000004E2000-memory.dmp