Analysis
- max time kernel
898s - max time network
473s - platform
windows11-21h2_x64 - resource
win11-20260513-it - resource tags
- submitted
20/06/2026, 11:08
General
- Target bin/tools/gengp4.exe
- Size 658KB
- Sample260620-m8v1vsfx2x
- SHA256 65042f9982e6db4c8610e8e735ca296e685518917cb71e7db42451b5069846e6
Malware Config
Signatures
- UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 21 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bin\tools\gengp4.exe"C:\Users\Admin\AppData\Local\Temp\bin\tools\gengp4.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5084-0-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-1-0x0000000002890000-0x0000000002891000-memory.dmp
memory/5084-2-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-4-0x0000000002890000-0x0000000002891000-memory.dmp
memory/5084-3-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-5-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-6-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-7-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-8-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-10-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-11-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-12-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-13-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-14-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-15-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-16-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-17-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-18-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-19-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-20-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-21-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-23-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-24-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-25-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-26-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-27-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-28-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-29-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-30-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-31-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-32-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-33-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-34-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-35-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-36-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-37-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-38-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-39-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-40-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-41-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-42-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-43-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-44-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-45-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-46-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-47-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-48-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-49-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-50-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-51-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-52-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-53-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-54-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-55-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-56-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-57-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-58-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-59-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-60-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-61-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-63-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-64-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-65-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-66-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-67-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-68-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-69-0x0000000000400000-0x0000000000672000-memory.dmp
memory/5084-70-0x0000000000400000-0x0000000000672000-memory.dmp