Analysis
- user interaction
yes - max time kernel
173s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
29/06/2026, 22:13
General
- Target Antidote Spoofer.exe
- Size 14.2MB
- Sample260629-15gkysgv21
- SHA256 02917c98b39013d382b72781b144759570294bb42e68fc4397f5396011b9185c
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Executes dropped EXE 9 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- UPX packed file 1 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 10 IoCs
- Suspicious behavior: EnumeratesProcesses 59 IoCs
- Suspicious behavior: LoadsDriver 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Antidote Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\Antidote Spoofer.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -Command Get-MpPreference | Select-Object -ExpandProperty DisableRealtimeMonitoring2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe"C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe" /SS "3THDNRR1VLJA54CV"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe"C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe" /BS "JUAXVIY0MAS50DLA"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe"C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe" /IV "3C49KRQXNN"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe"C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe" /IVN "64OSQVZDTEAZ"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe"C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe" /SU "F7CFEEDE-C601-4BA6-B50B-563997FA71F1"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe"C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe" /BS "7392S75QZFJ9642C"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe"C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe" /BS "7392S75QZFJ9642C"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe"C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe" /SS "8VZV5L8UMDG6HF10"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe"C:\Users\Admin\AppData\Local\Temp\KernelMapper.exe" /SM "sechex-885433"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
KernelMapper.exe
__PSScriptPolicyTest_capoyykp.lnj.ps1
memory/3840-13-0x00000187A10D0000-0x00000187A10E0000-memory.dmp
memory/3840-12-0x00000187A10D0000-0x00000187A10E0000-memory.dmp
memory/3840-4-0x00000187A1DA0000-0x00000187A2176000-memory.dmp
memory/3840-6-0x00000187A2660000-0x00000187A2674000-memory.dmp
memory/3840-1-0x00000187A10D0000-0x00000187A10E0000-memory.dmp
memory/3840-8-0x00000187A10D0000-0x00000187A10E0000-memory.dmp
memory/3840-9-0x00000187A3940000-0x00000187A395A000-memory.dmp
memory/3840-10-0x00000187A3A40000-0x00000187A3AF2000-memory.dmp
memory/3840-11-0x00000187A10D0000-0x00000187A10E0000-memory.dmp
memory/3840-2-0x00000187A10D0000-0x00000187A10E0000-memory.dmp
memory/3840-15-0x00000187A10D0000-0x00000187A10E0000-memory.dmp
memory/3840-42-0x00000187A10D0000-0x00000187A10E0000-memory.dmp
memory/3840-3-0x00000187A0EE0000-0x00000187A102E000-memory.dmp
memory/3840-0-0x00000187857C0000-0x00000187865F6000-memory.dmp
memory/3840-7-0x00000187A10D0000-0x00000187A10E0000-memory.dmp
memory/3840-41-0x00000187A10D0000-0x00000187A10E0000-memory.dmp
memory/3840-40-0x00000187A10D0000-0x00000187A10E0000-memory.dmp
memory/4796-37-0x000002BCB3CC0000-0x000002BCB3CCA000-memory.dmp
memory/4796-32-0x000002BCB3C90000-0x000002BCB3CAC000-memory.dmp
memory/4796-33-0x000002BCB3C70000-0x000002BCB3C7A000-memory.dmp
memory/4796-34-0x000002BCB4140000-0x000002BCB415A000-memory.dmp
memory/4796-35-0x000002BCB3C80000-0x000002BCB3C88000-memory.dmp
memory/4796-36-0x000002BCB3CB0000-0x000002BCB3CB6000-memory.dmp
memory/4796-31-0x000002BCB3B80000-0x000002BCB3B8A000-memory.dmp
memory/4796-30-0x000002BCB3BB0000-0x000002BCB3C63000-memory.dmp
memory/4796-29-0x000002BCB3B90000-0x000002BCB3BAC000-memory.dmp
memory/4796-14-0x000002BCB2D70000-0x000002BCB2D80000-memory.dmp
memory/4796-22-0x000002BC9A940000-0x000002BC9A962000-memory.dmp