Overview

overview

8

Static

static

3

kdmapper_Release.exe

windows10-ltsc_2021-x64

8

nogibogi.exe

windows10-ltsc_2021-x64

8

rename.sys

windows10-ltsc_2021-x64

1

Analysis

  • user interaction
    yes
  • max time kernel
    88s
  • max time network
    90s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    22/06/2026, 09:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    nogibogi.exe
  • Size 1.2MB
  • Sample260622-ln1vyabt21
  • SHA256 44ddd284cf9098f6583531a69276f0489e4f4ab2f59157b1f5d6585635b74380
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
persistenceprivilege_escalation

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Executes dropped EXE 1 IoCs
  • Event Triggered Execution: Accessibility Features 1 TTPs

    Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.

    persistenceprivilege_escalation
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\nogibogi.exe
    "C:\Users\Admin\AppData\Local\Temp\nogibogi.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3744
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
        PID:3500
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c pause
        2⤵
          PID:3196
      • C:\Windows\system32\osk.exe
        "C:\Windows\system32\osk.exe"
        1⤵
        • Suspicious use of SetWindowsHookEx
        PID:1828
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x514 0x510
        1⤵
          PID:1624
        • C:\Windows\System32\rundll32.exe
          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
          1⤵
            PID:3120
          • C:\Users\Admin\Desktop\kdmapper_Release.exe
            "C:\Users\Admin\Desktop\kdmapper_Release.exe" C:\Users\Admin\Desktop\rename.sys
            1⤵
            • Downloads MZ/PE file
            • Sets service image path in registry
            • Suspicious behavior: LoadsDriver
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:824
            • C:\Windows\system32\cmd.exe
              /c start C:\Users\Admin\AppData\Local\Temp\ox_1782121357960.exe
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2424
              • C:\Users\Admin\AppData\Local\Temp\ox_1782121357960.exe
                C:\Users\Admin\AppData\Local\Temp\ox_1782121357960.exe
                3⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1588

          Network

                MITRE ATT&CK Enterprise v16

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                ox_1782121357960.exe
                • Path C:\Users\Admin\AppData\Local\Temp\ox_1782121357960.exe
                • Size 277KB
                • SHA256 600fd59a6114e08606f4bbc881c1c156193ff01371e1144a05ca787d365e067d
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/824-1-0x0000000140000000-0x000000014003E000-memory.dmp
                Download

                memory/824-16-0x0000000140000000-0x000000014003E000-memory.dmp
                Download